{
  "apiVersion": "clearcutt.dev/v1",
  "kind": "EstateHistory",
  "name": "clearcutt-showcase",
  "entries": [
    {
      "generatedAt": "2026-10-19T07:41:28Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 1,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 8
          },
          "recipe": {
            "verified": 8,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 1
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 8,
            "failed": 0,
            "missing": 1,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-19T01:05:47Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 1,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 8
          },
          "recipe": {
            "verified": 8,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 1
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 8,
            "failed": 0,
            "missing": 1,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-19T01:02:41Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 1,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 8
          },
          "recipe": {
            "verified": 8,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 1
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 8,
            "failed": 0,
            "missing": 1,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-19T00:27:46Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 1,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 8
          },
          "recipe": {
            "verified": 8,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 1
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 8,
            "failed": 0,
            "missing": 1,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-19T00:20:38Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 1,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 8
          },
          "recipe": {
            "verified": 8,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 1
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 8,
            "failed": 0,
            "missing": 1,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-18T14:29:11Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 1,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 8
          },
          "recipe": {
            "verified": 8,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 1
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 8,
            "failed": 0,
            "missing": 1,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-18T14:11:46Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:2bde717bdacf1ecd47db26ea506492f83832511e75f7bda467af8967f94367fa",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-18T14:10:02Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:2bde717bdacf1ecd47db26ea506492f83832511e75f7bda467af8967f94367fa",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-18T07:25:30Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 3,
          "stale": 6
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:2bde717bdacf1ecd47db26ea506492f83832511e75f7bda467af8967f94367fa",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "stale",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-17T14:43:03Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 9,
          "stale": 0
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:2bde717bdacf1ecd47db26ea506492f83832511e75f7bda467af8967f94367fa",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-17T14:38:50Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 9,
          "stale": 0
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:2bde717bdacf1ecd47db26ea506492f83832511e75f7bda467af8967f94367fa",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-17T14:06:13Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 9,
          "stale": 0
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:2bde717bdacf1ecd47db26ea506492f83832511e75f7bda467af8967f94367fa",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-17T14:03:11Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 9,
          "stale": 0
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:9da17d04907eeb3efabd2bdf44f716d34f448d1fcf9c207ea4745cf477045243"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:9ab48e82e513c768223c27e6bddfc5064c480cdcabc47bcd65e62e6b8195161b"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:2bde717bdacf1ecd47db26ea506492f83832511e75f7bda467af8967f94367fa",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-17T12:20:33Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 9,
          "stale": 0
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:bed8ceec67c59dd3e76153191c52a9b80556b86d7ba171ec1d610b780295fd67",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:c03b1a22b73f95861829154e93ca7a65e3f5668fe2af76350615ee2398558e45"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:d12eb933237169590b5fcc354a3bc2573f45e0417bb54babbf80122bf83dd548",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:425c62aea92ea1468b6c8ba822c45c385aa43b16d7288dcfbd23490e84243762"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3107bab01521cc717d59ab333116afd3286647d4056a80ad051c6c722cfd42a8"
        },
        {
          "id": "catalog",
          "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:b93802e84268465beafc798ebad73b362ed7b53130f7189e7f63d8e15ebcd477"
        },
        {
          "id": "checkout",
          "digest": "sha256:2bde717bdacf1ecd47db26ea506492f83832511e75f7bda467af8967f94367fa",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:dd49a5b0238575d7b458c15d1fe3ea04d5cd389a9d97e45b3fad52dfdae24655"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d429c53bf38c7f45838e5884f5e294499dcfe8e974801134fba77768cb3ffda5"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:d4bbe2e21924c801a37eb1eff9d09b786ed28e8ed9b1df7f003a261be9c1234c"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:ca1e7303342a658d307e67059c0c69f55c9750f957d1d886bb3ffb7969130a41"
        },
        {
          "id": "storefront",
          "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1",
          "verdict": "verified",
          "base": {
            "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:f416a5338e9116f052d05b44c197289d89ed57539f8c7e98ab92bd6c66a86747"
        }
      ]
    },
    {
      "generatedAt": "2026-10-17T07:25:06Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 9,
          "stale": 0
        },
        "vulnerabilities": {
          "counts": {
            "critical": 24,
            "high": 138,
            "medium": 88,
            "low": 49,
            "negligible": 0,
            "unknown": 15
          },
          "fixable": {
            "critical": 0,
            "high": 17,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 15
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:bed8ceec67c59dd3e76153191c52a9b80556b86d7ba171ec1d610b780295fd67",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:c03b1a22b73f95861829154e93ca7a65e3f5668fe2af76350615ee2398558e45"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:d12eb933237169590b5fcc354a3bc2573f45e0417bb54babbf80122bf83dd548",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:425c62aea92ea1468b6c8ba822c45c385aa43b16d7288dcfbd23490e84243762"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:6d1af765e4a7b20f188729fc7855e9b332ca59be009923839c272e589140ca58",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:8127c4f31a364e78299648a187b2d164f8f7670bb1a1e860194c29f164eb682b"
        },
        {
          "id": "catalog",
          "digest": "sha256:b5944261ebe6bdb6339ef3edd7bbba0a25f5fc1f2d034223dca0f1ef5dd4233b",
          "verdict": "verified",
          "base": {
            "digest": "sha256:4844ef0efd83b1549f5ab04c420965bde1f996a2a1451255f9f67aacf2fb2cd9",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 13,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:5328feeb464ab05774630c47f9497537379faac56de0f95f6ba45c076862609c"
        },
        {
          "id": "checkout",
          "digest": "sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "verdict": "verified",
          "base": {
            "digest": "sha256:48499cde6a171524f76aa6154b3f67c3c451f793ae662b5695e525e68dcf7b2d",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:f35fff619097e0cdcea224ed597f641d8353cbbe268e6c595c1cb2e67c2f1872",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 13,
            "low": 8,
            "negligible": 0,
            "unknown": 5
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:628a01ac89a12b6cd7e8793f6778e0cc62c66a378f95c85c730b45674f09960d"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:48499cde6a171524f76aa6154b3f67c3c451f793ae662b5695e525e68dcf7b2d",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 12,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:93e7e3f931bceece795ec92acd84fb916b0bb296e9d89bd114622dc98d04ac2e"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:f12bc0c8f6b01291d7a638c046b8f824359678c20172421b839a67cc408f5187",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 12,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:8b1198b9f10bf364c53c810acf289f1c3f6280bccaf533b20ea3271cd39491bc"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:4844ef0efd83b1549f5ab04c420965bde1f996a2a1451255f9f67aacf2fb2cd9",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 13,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:dad8c8b13012d53825abf1dbbc6bd8682efa003680932e01d4f3ff2432edcd66"
        },
        {
          "id": "storefront",
          "digest": "sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f12bc0c8f6b01291d7a638c046b8f824359678c20172421b839a67cc408f5187",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:87f0c05ee581231942adbf0274eafe6ed4406f9680c40676ae22859c1e6e5cb8",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 12,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:480bede8af380608960df5e5f0cd54d0faf4effa189a61e60c1abb6279f0d67b"
        }
      ]
    },
    {
      "generatedAt": "2026-10-17T03:58:20Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 2,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 7
          },
          "recipe": {
            "verified": 7,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 2
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 7,
            "failed": 0,
            "missing": 2,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 9,
          "stale": 0
        },
        "vulnerabilities": {
          "counts": {
            "critical": 24,
            "high": 138,
            "medium": 88,
            "low": 49,
            "negligible": 0,
            "unknown": 15
          },
          "fixable": {
            "critical": 0,
            "high": 17,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 15
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:bed8ceec67c59dd3e76153191c52a9b80556b86d7ba171ec1d610b780295fd67",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:c03b1a22b73f95861829154e93ca7a65e3f5668fe2af76350615ee2398558e45"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:d12eb933237169590b5fcc354a3bc2573f45e0417bb54babbf80122bf83dd548",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:425c62aea92ea1468b6c8ba822c45c385aa43b16d7288dcfbd23490e84243762"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:6d1af765e4a7b20f188729fc7855e9b332ca59be009923839c272e589140ca58",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:8127c4f31a364e78299648a187b2d164f8f7670bb1a1e860194c29f164eb682b"
        },
        {
          "id": "catalog",
          "digest": "sha256:b5944261ebe6bdb6339ef3edd7bbba0a25f5fc1f2d034223dca0f1ef5dd4233b",
          "verdict": "verified",
          "base": {
            "digest": "sha256:4844ef0efd83b1549f5ab04c420965bde1f996a2a1451255f9f67aacf2fb2cd9",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 13,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:5328feeb464ab05774630c47f9497537379faac56de0f95f6ba45c076862609c"
        },
        {
          "id": "checkout",
          "digest": "sha256:e67531bdf7d6a0f77f8c07c32efabc60c7733023c0a49923d979e64fb11e5143",
          "verdict": "verified",
          "base": {
            "digest": "sha256:48499cde6a171524f76aa6154b3f67c3c451f793ae662b5695e525e68dcf7b2d",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:f35fff619097e0cdcea224ed597f641d8353cbbe268e6c595c1cb2e67c2f1872",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 13,
            "low": 8,
            "negligible": 0,
            "unknown": 5
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:628a01ac89a12b6cd7e8793f6778e0cc62c66a378f95c85c730b45674f09960d"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:48499cde6a171524f76aa6154b3f67c3c451f793ae662b5695e525e68dcf7b2d",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 12,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:93e7e3f931bceece795ec92acd84fb916b0bb296e9d89bd114622dc98d04ac2e"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:f12bc0c8f6b01291d7a638c046b8f824359678c20172421b839a67cc408f5187",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 12,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:8b1198b9f10bf364c53c810acf289f1c3f6280bccaf533b20ea3271cd39491bc"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:4844ef0efd83b1549f5ab04c420965bde1f996a2a1451255f9f67aacf2fb2cd9",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 13,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:dad8c8b13012d53825abf1dbbc6bd8682efa003680932e01d4f3ff2432edcd66"
        },
        {
          "id": "storefront",
          "digest": "sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99",
          "verdict": "verified",
          "base": {
            "digest": "sha256:f12bc0c8f6b01291d7a638c046b8f824359678c20172421b839a67cc408f5187",
            "drift": "current",
            "strength": "proof"
          },
          "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:87f0c05ee581231942adbf0274eafe6ed4406f9680c40676ae22859c1e6e5cb8",
          "rebaseStatus": "verified",
          "vulnerabilities": {
            "critical": 4,
            "high": 22,
            "medium": 12,
            "low": 8,
            "negligible": 0,
            "unknown": 2
          },
          "fixableFindings": [
            "CVE-2026-14456"
          ],
          "packagesDigest": "sha256:480bede8af380608960df5e5f0cd54d0faf4effa189a61e60c1abb6279f0d67b"
        }
      ]
    },
    {
      "generatedAt": "2026-10-17T01:19:51Z",
      "ref": "estate-report.json",
      "summary": {
        "images": 9,
        "verdicts": {
          "verified": 9,
          "failed": 0,
          "unverified": 0
        },
        "evidence": {
          "provenance": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "rebase": {
            "verified": 0,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 9
          },
          "recipe": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "sbom": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "signature": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "tests": {
            "verified": 0,
            "present": 9,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          },
          "vulnerabilityScan": {
            "verified": 9,
            "present": 0,
            "failed": 0,
            "missing": 0,
            "unknown": 0,
            "notApplicable": 0
          }
        },
        "bases": {
          "proven": 9,
          "claimed": 0,
          "unresolved": 0,
          "roots": 0,
          "current": 9,
          "stale": 0
        },
        "vulnerabilities": {
          "counts": {
            "critical": 0,
            "high": 6,
            "medium": 16,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "fixable": {
            "critical": 0,
            "high": 5,
            "medium": 13,
            "low": 1,
            "negligible": 0,
            "unknown": 3
          },
          "scanned": 9,
          "notScanned": 0
        },
        "packages": {
          "known": 9,
          "unknown": 0
        },
        "reproducibility": {
          "reproduced": 9,
          "notReproduced": 0,
          "notChecked": 0,
          "noRecipe": 0
        }
      },
      "images": [
        {
          "id": "build-go-1",
          "digest": "sha256:bed8ceec67c59dd3e76153191c52a9b80556b86d7ba171ec1d610b780295fd67",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:c03b1a22b73f95861829154e93ca7a65e3f5668fe2af76350615ee2398558e45"
        },
        {
          "id": "build-node-24",
          "digest": "sha256:d12eb933237169590b5fcc354a3bc2573f45e0417bb54babbf80122bf83dd548",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 6,
            "medium": 12,
            "low": 1,
            "negligible": 0,
            "unknown": 0
          },
          "fixableFindings": [
            "GHSA-6j4f-fj2g-mc7p",
            "GHSA-mwp4-54f8-5fhr",
            "GHSA-qhr7-859c-m2p7",
            "GHSA-rfgv-xxqx-mfg5",
            "GHSA-rgw5-rvv9-x895"
          ],
          "packagesDigest": "sha256:425c62aea92ea1468b6c8ba822c45c385aa43b16d7288dcfbd23490e84243762"
        },
        {
          "id": "build-python-3-14",
          "digest": "sha256:3864925726209fccb293ad7d5bcf325fa86feba816d904a06904bcb9abff9b0c",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:5420582cc03364650428dec7dc9bd5cfee63e49c109ba0fce4b6db20c322f5ad"
        },
        {
          "id": "catalog",
          "digest": "sha256:15bf287835f1780c18b6a5781280cd44fbe3a0ef9854cd04d24087817bb7fdaf",
          "verdict": "verified",
          "base": {
            "digest": "sha256:db399d4a7592268a4cb76eb69d6395da221539d256f99daadda7b5e1436059c7",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:3cab55a8aaea1d8a832b1aaab2c9f1a678195f82b06aee9b33aa5c68cf1a3539"
        },
        {
          "id": "checkout",
          "digest": "sha256:f35fff619097e0cdcea224ed597f641d8353cbbe268e6c595c1cb2e67c2f1872",
          "verdict": "verified",
          "base": {
            "digest": "sha256:3f495a2e2d26336535f649e2ba1e4f4d90433b4796b640e61f03f56338ba2575",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 3
          },
          "packagesDigest": "sha256:3c1fa8d6a4735ed025512dea563599c7693d52e035a4875b381de711c3e6e107"
        },
        {
          "id": "run-go-1",
          "digest": "sha256:3f495a2e2d26336535f649e2ba1e4f4d90433b4796b640e61f03f56338ba2575",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:8fc3f225c4fe437d42461903d70a012da4439a1c64ac28ad6a67e1f802416e29"
        },
        {
          "id": "run-node-24",
          "digest": "sha256:756d5eb4c0aed7b2e1604fad9ffd6d58ddb92ef2a7e045ec9752301bf82a6d4f",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:c5e452ac735c5652c4b88b3fee7ec2b39923b6a1f09fbd2c86dd78eeb6f9b221"
        },
        {
          "id": "run-python-3-14",
          "digest": "sha256:db399d4a7592268a4cb76eb69d6395da221539d256f99daadda7b5e1436059c7",
          "verdict": "verified",
          "base": {
            "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4",
            "platform": "linux/amd64",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 1,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:6437a67cf085fc455fdd53c949b155b64424431c111c2debc6401ad90e7a61c0"
        },
        {
          "id": "storefront",
          "digest": "sha256:87f0c05ee581231942adbf0274eafe6ed4406f9680c40676ae22859c1e6e5cb8",
          "verdict": "verified",
          "base": {
            "digest": "sha256:756d5eb4c0aed7b2e1604fad9ffd6d58ddb92ef2a7e045ec9752301bf82a6d4f",
            "drift": "current",
            "strength": "proof"
          },
          "vulnerabilities": {
            "critical": 0,
            "high": 0,
            "medium": 0,
            "low": 0,
            "negligible": 0,
            "unknown": 0
          },
          "packagesDigest": "sha256:8cb49ce711770020a8a4fa56c62b9efbc24ab1b563202db472814f6141f79f08"
        }
      ]
    }
  ]
}