{ "apiVersion": "clearcutt.dev/v1", "kind": "EstateReport", "metadata": { "name": "clearcutt-showcase", "generatedAt": "2026-10-19T07:41:28Z", "generator": { "name": "clearcutt-verify", "version": "v0.16.0" }, "sources": [ { "registry": "ghcr.io", "repositories": [ "northcutted/clearcutt-showcase/apps/catalog", "northcutted/clearcutt-showcase/apps/checkout", "northcutted/clearcutt-showcase/apps/storefront", "northcutted/clearcutt-showcase/platform/build-go", "northcutted/clearcutt-showcase/platform/build-node", "northcutted/clearcutt-showcase/platform/build-python", "northcutted/clearcutt-showcase/platform/run-go", "northcutted/clearcutt-showcase/platform/run-node", "northcutted/clearcutt-showcase/platform/run-python" ] } ] }, "policy": { "required": [ "signature", "sbom", "vulnerabilityScan", "provenance", "recipe" ], "trustedSigners": [ { "identityRegexp": "^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main", "sourceMatchesImage": true }, { "identityRegexp": "^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-checkout", "sourceRef": "refs/heads/main", "sourceMatchesImage": true }, { "identityRegexp": "^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-catalog", "sourceRef": "refs/heads/main", "sourceMatchesImage": true }, { "identityRegexp": "^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-storefront", "sourceRef": "refs/heads/main", "sourceMatchesImage": true } ], "failOn": "critical", "onlyFixed": true, "maxDaysBehind": 7, "stackSigners": [ { "identity": "https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main", "issuer": "https://token.actions.githubusercontent.com" } ], "reproduce": true }, "summary": { "images": 9, "verdicts": { "verified": 9, "failed": 0, "unverified": 0 }, "evidence": { "provenance": { "verified": 9, "present": 0, "failed": 0, "missing": 0, "unknown": 0, "notApplicable": 0 }, "rebase": { "verified": 1, "present": 0, "failed": 0, "missing": 0, "unknown": 0, "notApplicable": 8 }, "recipe": { "verified": 8, "present": 0, "failed": 0, "missing": 0, "unknown": 0, "notApplicable": 1 }, "sbom": { "verified": 9, "present": 0, "failed": 0, "missing": 0, "unknown": 0, "notApplicable": 0 }, "signature": { "verified": 9, "present": 0, "failed": 0, "missing": 0, "unknown": 0, "notApplicable": 0 }, "tests": { "verified": 0, "present": 8, "failed": 0, "missing": 1, "unknown": 0, "notApplicable": 0 }, "vulnerabilityScan": { "verified": 9, "present": 0, "failed": 0, "missing": 0, "unknown": 0, "notApplicable": 0 } }, "bases": { "proven": 9, "claimed": 0, "unresolved": 0, "roots": 0, "current": 3, "stale": 6 }, "vulnerabilities": { "counts": { "critical": 0, "high": 6, "medium": 16, "low": 1, "negligible": 0, "unknown": 3 }, "fixable": { "critical": 0, "high": 5, "medium": 13, "low": 1, "negligible": 0, "unknown": 3 }, "scanned": 9, "notScanned": 0 }, "packages": { "known": 9, "unknown": 0 }, "reproducibility": { "reproduced": 9, "notReproduced": 0, "notChecked": 0, "noRecipe": 0 } }, "images": [ { "id": "build-go-1", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/build-go", "tags": [ "1" ], "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2", "created": "2026-10-16T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:383d16a2b8430d1ffebaab0eef20ceeb63aaf6dc5cfb23c33919ab194cb34e2d", "size": 87953259, "layers": 12 }, { "platform": "linux/arm64", "digest": "sha256:5cbc804fcad6f3582de7ea535a3f7769223b544acbbaba8168012b7ac9ee07a4", "size": 82258344, "layers": 12 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory recipe" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-platform", "revision": "ab3eb4f659ee317a65e39b28550c705ce089f34c", "basis": "provenance" }, "description": "Build image for Go apps (stack go:1)", "base": { "repository": "cgr.dev/chainguard/wolfi-base", "ref": "cgr.dev/chainguard/wolfi-base:latest", "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4", "platform": "linux/amd64", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "stale", "versionsBehind": 1, "daysBehind": 5, "currentRef": "cgr.dev/chainguard/wolfi-base:latest", "currentDigest": "sha256:e2d3af72b200cd61e5413ca4b24d10c54b7bb1cd03e06395126bafd27dd34f89" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:afc0e015e511d24c31730d6106ac76357f962e0166033f7096bf2565d3b9ff0e", "timestamp": "2026-10-17T13:51:50Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:1786fed1cd80e15d22126c0edcea16efa8a74027b43925ca236cf2a87b9b3600", "timestamp": "2026-10-17T13:52:21Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:dfcf2ad3e794abfcbd4c72c0a527e5464812ad75d4a1d772e4eb12169d698f34", "timestamp": "2026-10-17T13:52:25Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:09280d70967164e3cf098c8523910d7f6d30d6ad5c4fe83fd2cd12e029d2e561", "timestamp": "2026-10-17T13:52:47Z" }, "recipe": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/recipe/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:77bf32621e84966bd4a7f6facc3bfe548f3517e5d54b34ae7e4a6cfc2c6ee1b9", "timestamp": "2026-10-17T13:52:09Z" }, "rebase": { "status": "not-applicable", "detail": "No rebase record: the image was built, not rebased." }, "tests": { "status": "present", "source": "recipe", "detail": "The verified recipe declares a smoke test (/bin/sh -c test \"$(id -u)\" = 65532 \u0026\u0026 go version \u0026\u0026 git --version) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-17T13:51:39Z", "counts": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "fixable": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "findings": [] }, "reproducibility": { "status": "reproduced", "method": "recipe-rebuild", "checkedAt": "2026-10-17T13:55:01Z", "digest": "sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2", "detail": "Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39038127661/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39038127661/attempts/1", "workflow": "northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main", "job": "reproduce", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.3.0", "buildkit": "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:bcc929680e320a4b4a43811b9a19ac38eaaa9e40f4843e61bcb9bcddf311ec0b" }, "factory": { "kind": "Image", "name": "build-go", "version": "v0.3.0", "sourceDateEpoch": 1792108800, "inputs": { "packages": 45, "tools": 0, "images": 4 } }, "packages": 56, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] }, { "id": "build-node-24", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/build-node", "tags": [ "24" ], "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20", "created": "2026-10-16T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:b6e82726ad9e94c0c4d8eae208a09295c631b405c18e7717c47afd814c92b6bb", "size": 61712606, "layers": 12 }, { "platform": "linux/arm64", "digest": "sha256:92debff5e5c221ec2d7e1033b8236ad358b41855c6ae9caf3f4ce41d22a874b7", "size": 59051361, "layers": 12 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory recipe" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-platform", "revision": "a61dd74b373c88f6d5efa00c8c9fa045834afadd", "basis": "provenance" }, "description": "Build image for Node.js 24 apps (stack node:1)", "base": { "repository": "cgr.dev/chainguard/wolfi-base", "ref": "cgr.dev/chainguard/wolfi-base:latest", "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4", "platform": "linux/amd64", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "stale", "versionsBehind": 1, "daysBehind": 5, "currentRef": "cgr.dev/chainguard/wolfi-base:latest", "currentDigest": "sha256:e2d3af72b200cd61e5413ca4b24d10c54b7bb1cd03e06395126bafd27dd34f89" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:63264737507814536cd84123914fcf4399bd3e066ba2a87ad55088baa3ef71f8", "timestamp": "2026-10-17T13:57:46Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:f2ed6c90dde86a202d76c57a379e6af9ac546b39547114f7fdaeaef01b9a1290", "timestamp": "2026-10-17T13:58:55Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:1d3c4d51ce38328c22392d9cf0d532c40fb660eaa70c890e98c39f782981ca11", "timestamp": "2026-10-17T13:59:01Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:9537e5253ec78f1ae6181f7deaf9ced0bf2696c30315812dffe58f7477c0b63f", "timestamp": "2026-10-17T13:59:19Z" }, "recipe": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/recipe/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:760a6bd04ae225755d41c01acfcc47c8dcb8cf3f2e5fb33e2d2f592a765db94f", "timestamp": "2026-10-17T13:57:57Z" }, "rebase": { "status": "not-applicable", "detail": "No rebase record: the image was built, not rebased." }, "tests": { "status": "present", "source": "recipe", "detail": "The verified recipe declares a smoke test (/bin/sh -c test \"$(id -u)\" = 65532 \u0026\u0026 node --version \u0026\u0026 npm --version) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-17T13:57:36Z", "counts": { "critical": 0, "high": 6, "medium": 12, "low": 1, "negligible": 0, "unknown": 0 }, "fixable": { "critical": 0, "high": 5, "medium": 12, "low": 1, "negligible": 0, "unknown": 0 }, "findings": [ { "id": "GHSA-6j4f-fj2g-mc7p", "severity": "high", "package": "brace-expansion", "version": "5.0.8", "fixedIn": [ "5.0.10" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-ch52-4w7c-c8xp", "severity": "high", "package": "http-cache-semantics", "version": "4.2.0", "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-mwp4-54f8-5fhr", "severity": "high", "package": "ip-address", "version": "10.2.0", "fixedIn": [ "10.3.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-qhr7-859c-m2p7", "severity": "high", "package": "brace-expansion", "version": "5.0.8", "fixedIn": [ "5.0.11" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-rfgv-xxqx-mfg5", "severity": "high", "package": "undici", "version": "6.27.0", "fixedIn": [ "6.28.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-rgw5-rvv9-x895", "severity": "high", "package": "brace-expansion", "version": "5.0.8", "fixedIn": [ "5.0.9" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-22jq-vg5j-6vgg", "severity": "medium", "package": "ip-address", "version": "10.2.0", "fixedIn": [ "10.2.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-2vr4-cq9g-pvrc", "severity": "medium", "package": "ip-address", "version": "10.2.0", "fixedIn": [ "10.5.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-3wwx-pv8p-q78v", "severity": "medium", "package": "undici", "version": "6.27.0", "fixedIn": [ "6.28.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-4xrf-jv44-h6hh", "severity": "medium", "package": "ip-address", "version": "10.2.0", "fixedIn": [ "10.2.2" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-8xcm-r25x-g524", "severity": "medium", "package": "undici", "version": "6.27.0", "fixedIn": [ "6.28.0" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-h3mg-xc3c-68pw", "severity": "medium", "package": "ip-address", "version": "10.2.0", "fixedIn": [ "10.7.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-j6r3-76f7-8jcv", "severity": "medium", "package": "ip-address", "version": "10.2.0", "fixedIn": [ "10.7.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-m8rv-5g2x-5cg5", "severity": "medium", "package": "undici", "version": "6.27.0", "fixedIn": [ "6.28.0" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-q2hr-2g5m-vwhr", "severity": "medium", "package": "brace-expansion", "version": "5.0.8", "fixedIn": [ "5.0.12" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-rj75-hqrm-r3gf", "severity": "medium", "package": "postcss-selector-parser", "version": "7.1.4", "fixedIn": [ "7.1.6" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-rpw4-54j3-4h4q", "severity": "medium", "package": "ip-address", "version": "10.2.0", "fixedIn": [ "10.5.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-v3r7-h72x-cjcm", "severity": "medium", "package": "undici", "version": "6.27.0", "fixedIn": [ "6.28.0" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GHSA-r53p-7pc4-xj5r", "severity": "low", "package": "undici", "version": "6.27.0", "fixedIn": [ "6.28.1" ], "platforms": [ "linux/amd64", "linux/arm64" ] } ] }, "reproducibility": { "status": "reproduced", "method": "recipe-rebuild", "checkedAt": "2026-10-17T14:01:17Z", "digest": "sha256:b5aae0baa10365078fd9e7ef073333689935d6fc1935b254a87439bc5ba7ea20", "detail": "Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39038131198/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39038131198/attempts/1", "workflow": "northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main", "job": "reproduce", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.3.0", "buildkit": "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-node@sha256:fb356fbf551ff28e0236f2b3123b105da05e30cd38282fc0603feee9ee8e522d" }, "factory": { "kind": "Image", "name": "build-node", "version": "v0.3.0", "sourceDateEpoch": 1792108800, "inputs": { "packages": 28, "tools": 0, "images": 4 } }, "packages": 176, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] }, { "id": "build-python-3-14", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/build-python", "tags": [ "3.14" ], "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3", "created": "2026-10-16T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:c6d9785a97867ae6f822c3aec60d46b715dec192e67ea304b54844dbe69dd043", "size": 225521626, "layers": 12 }, { "platform": "linux/arm64", "digest": "sha256:7d8447ea012a97f2e15047705fbc6b1e7dbb4037132c8df58e6916e92ac102b1", "size": 213101536, "layers": 12 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory recipe" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-platform", "revision": "0131f755c5bff2c855db0583fe9501feb1fa4457", "basis": "provenance" }, "description": "Build image for Python 3.14 apps (stack python:1)", "base": { "repository": "cgr.dev/chainguard/wolfi-base", "ref": "cgr.dev/chainguard/wolfi-base:latest", "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4", "platform": "linux/amd64", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "stale", "versionsBehind": 1, "daysBehind": 5, "currentRef": "cgr.dev/chainguard/wolfi-base:latest", "currentDigest": "sha256:e2d3af72b200cd61e5413ca4b24d10c54b7bb1cd03e06395126bafd27dd34f89" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:4fff10f5656512c76db6ebaf5345ffb7c3aed0b0495fd590af81a639a9924f3a", "timestamp": "2026-10-17T12:00:16Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:4a8573489faf09f5043c98e846fb632a2e83b09863e3b1f8ca3ab2a3e838c242", "timestamp": "2026-10-17T12:00:28Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:ccf50581564ce55c716261a0df1184c266a4102c4b1f0eae4bfec308ea33cd09", "timestamp": "2026-10-17T12:00:32Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:417bac51154b19575fddc1b95e6e3639e033efd193eeebcc9f76ac5174960f54", "timestamp": "2026-10-17T12:00:42Z" }, "recipe": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/recipe/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:1bdff8a4246298c50660fa3659f7abae7e7d67dad05bf009b13e4e67c605d14e", "timestamp": "2026-10-17T12:00:24Z" }, "rebase": { "status": "not-applicable", "detail": "No rebase record: the image was built, not rebased." }, "tests": { "status": "present", "source": "recipe", "detail": "The verified recipe declares a smoke test (/bin/sh -c test \"$(id -u)\" = 65532 \u0026\u0026 python3 -m pip --version \u0026\u0026 cc --version \u0026\u0026 pkg-config --modversion libxml-2.0) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-17T11:59:55Z", "counts": { "critical": 0, "high": 0, "medium": 1, "low": 0, "negligible": 0, "unknown": 0 }, "fixable": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "findings": [ { "id": "CVE-2025-15367", "severity": "medium", "package": "python-3.14", "version": "3.14.8_git20261014-r0", "platforms": [ "linux/amd64", "linux/arm64" ] } ] }, "reproducibility": { "status": "reproduced", "method": "recipe-rebuild", "checkedAt": "2026-10-17T12:03:06Z", "digest": "sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3", "detail": "Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1", "workflow": "northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main", "job": "reproduce", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.2.0", "buildkit": "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:020ba9c55fefde94323e1ed974ada204645a7dbe4b49cb64f0bc181d1f898fe6" }, "factory": { "kind": "Image", "name": "build-python", "version": "v0.2.0", "sourceDateEpoch": 1792108800, "inputs": { "packages": 65, "tools": 0, "images": 4 } }, "packages": 79, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] }, { "id": "catalog", "repository": "ghcr.io/northcutted/clearcutt-showcase/apps/catalog", "tags": [ "latest" ], "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf", "created": "2026-10-16T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:f496f972939c87601e3b18c592deb925a84145ae53ebbbfa37f6106c89ca8d98", "size": 34592134, "layers": 14 }, { "platform": "linux/arm64", "digest": "sha256:59a07ba95e20a18ed123d2826d2ca55bf6a99ed3a57024c6ea852d36f8d37444", "size": 32430875, "layers": 14 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory recipe" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-catalog", "revision": "52f7db821a38db1ca04ba0d5efe57845138d897e", "basis": "provenance" }, "description": "Catalog service (Python 3.14, stack python:1)", "base": { "imageId": "run-python-3-14", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python:3.14", "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "current", "versionsBehind": 0, "daysBehind": 0, "currentRef": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python:3.14", "currentDigest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-catalog", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:d4767eb9effe34e6759a0b6458813c47d595c0a0341992b9c72dc855d24933f5", "timestamp": "2026-10-17T12:14:42Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-catalog", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:a375620caab2d3f30b31d54eabf62f09048622935dfeeb15cfb9628ccd634e14", "timestamp": "2026-10-17T12:14:55Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-catalog", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:43667050cbb33aa5ab45ddf3f387bea9e80c769e23431c698ce9374afea98d2a", "timestamp": "2026-10-17T12:14:59Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-catalog", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:8ab676e3b9fbd6269d961de644e1d00293043e2d27f9492941ab32488f0d5ff8", "timestamp": "2026-10-17T12:15:11Z" }, "recipe": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/recipe/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-catalog", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:e81a1dac27b6fc18a77f772f540872e329c0a5f0f1d4bfe136df2337f317970d", "timestamp": "2026-10-17T12:14:51Z" }, "rebase": { "status": "not-applicable", "detail": "No rebase record: the image was built, not rebased." }, "tests": { "status": "present", "source": "recipe", "detail": "The verified recipe declares a smoke test (GET :8080/healthz) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-17T12:14:32Z", "counts": { "critical": 0, "high": 0, "medium": 1, "low": 0, "negligible": 0, "unknown": 0 }, "fixable": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "findings": [ { "id": "CVE-2025-15367", "severity": "medium", "package": "python-3.14", "version": "3.14.8_git20261014-r0", "platforms": [ "linux/amd64", "linux/arm64" ] } ] }, "reproducibility": { "status": "reproduced", "method": "recipe-rebuild", "checkedAt": "2026-10-17T12:16:29Z", "digest": "sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf", "detail": "Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-catalog/actions/runs/39031596076/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-catalog/actions/runs/39031596076/attempts/1", "workflow": "northcutted/clearcutt-showcase-catalog/.github/workflows/factory.yml@refs/heads/main", "job": "reproduce", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.2.0", "buildkit": "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-catalog", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:aa7568e12ad405bfe8dfcf75d837780f0df3ae885cc5774e6d1bf052b21aef13" }, "factory": { "kind": "App", "name": "catalog", "stack": "python", "stackRef": "ghcr.io/northcutted/clearcutt-showcase/stacks/python:1", "stackDigest": "sha256:27b0653b10d1f992706d4a530e8a852b2e36c18bd4ef109e4c58613d1bacc0fd", "version": "v0.2.0", "sourceDateEpoch": 1792108800, "inputs": { "packages": 0, "tools": 0, "images": 5 } }, "packages": 47, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] }, { "id": "checkout", "repository": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout", "tags": [ "latest" ], "digest": "sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313", "created": "2026-10-17T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:6971d089b05e27045058e334f1ed5d1bc844039c510f01238633123b942f303f", "size": 17281814, "layers": 14 }, { "platform": "linux/arm64", "digest": "sha256:4d56ddccde41ab6872c2051a2678ca221a5bd2f25ab64c7868a2b8ffcf39312b", "size": 15322748, "layers": 14 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory recipe" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-checkout", "revision": "784b3b9991326a0e67d4089d0eb4daa9d5c6bf4e", "basis": "provenance" }, "description": "Checkout service (Go, stack go:1)", "base": { "imageId": "run-go-1", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go:1", "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "current", "versionsBehind": 0, "daysBehind": 0, "currentRef": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go:1", "currentDigest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-checkout", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:4e63dbc92be56a43d142369084d95da48c77abfb6a5c35b422721a2f55fa54cd", "timestamp": "2026-10-18T14:26:34Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-checkout", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:6f776aaccb1b26575f17f6f74b9a1448e552a4f0c58214c48bf8df25b2ee5407", "timestamp": "2026-10-18T14:26:53Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-checkout", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:daab2dd7a2da9db96439fd8b44abea32c468a10b4d85cd5e53acae76c5753ae3", "timestamp": "2026-10-18T14:26:57Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-checkout", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:4c513d7e9717c641cc2ac311a3195b363302aa603fee115296ca20cdcdd44442", "timestamp": "2026-10-18T14:27:10Z" }, "recipe": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/recipe/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-checkout", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:1f06483b8e48a9494a733ef1184cfac76cde084c610655fd75196d4a8d042e19", "timestamp": "2026-10-18T14:26:49Z" }, "rebase": { "status": "not-applicable", "detail": "No rebase record: the image was built, not rebased." }, "tests": { "status": "present", "source": "recipe", "detail": "The verified recipe declares a smoke test (GET :8080/healthz) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-18T14:26:24Z", "counts": { "critical": 0, "high": 0, "medium": 1, "low": 0, "negligible": 0, "unknown": 3 }, "fixable": { "critical": 0, "high": 0, "medium": 1, "low": 0, "negligible": 0, "unknown": 3 }, "findings": [ { "id": "GHSA-mqqf-5wvp-8fh8", "severity": "medium", "package": "github.com/go-chi/chi/v5", "version": "v5.2.3", "fixedIn": [ "5.2.4" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GO-2026-5774", "severity": "unknown", "package": "github.com/go-chi/chi/v5", "version": "v5.2.3", "fixedIn": [ "5.3.0" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GO-2026-5775", "severity": "unknown", "package": "github.com/go-chi/chi/v5", "version": "v5.2.3", "fixedIn": [ "5.3.0" ], "platforms": [ "linux/amd64", "linux/arm64" ] }, { "id": "GO-2026-5777", "severity": "unknown", "package": "github.com/go-chi/chi/v5", "version": "v5.2.3", "fixedIn": [ "5.3.0" ], "platforms": [ "linux/amd64", "linux/arm64" ] } ] }, "reproducibility": { "status": "reproduced", "method": "recipe-rebuild", "checkedAt": "2026-10-18T14:28:38Z", "digest": "sha256:b2f56e8e716f70fa5fd485b1c7db6ba9639f63bbb6371dd2dfd98144d5d83313", "detail": "Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-checkout/actions/runs/39135799332/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-checkout/actions/runs/39135799332/attempts/1", "workflow": "northcutted/clearcutt-showcase-checkout/.github/workflows/factory.yml@refs/heads/main", "job": "reproduce", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.3.0", "buildkit": "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-checkout", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/checkout@sha256:9595974021b29623ee696febb2bb1da1217b6fd7890855e3990fb787a65104b9" }, "factory": { "kind": "App", "name": "checkout", "stack": "go", "stackRef": "ghcr.io/northcutted/clearcutt-showcase/stacks/go:1", "stackDigest": "sha256:59ec0ee535b12f41f26f1cfcc5c5e44f400aa3609afe9dfa53974ebd1103da11", "version": "v0.3.0", "sourceDateEpoch": 1792195200, "inputs": { "packages": 0, "tools": 0, "images": 5 } }, "packages": 26, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] }, { "id": "run-go-1", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go", "tags": [ "1" ], "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb", "created": "2026-10-16T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:31fcb9452084b7946efc3ea9ee3bb64046634174d4716fef39ac5560b888a69e", "size": 14335135, "layers": 13 }, { "platform": "linux/arm64", "digest": "sha256:71befe80e15b6f565294297a06412610b6124a301c5bc7816aba53569edfbfe1", "size": 12652610, "layers": 13 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory recipe" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-platform", "revision": "0131f755c5bff2c855db0583fe9501feb1fa4457", "basis": "provenance" }, "description": "Run image for Go apps (stack go:1)", "base": { "repository": "cgr.dev/chainguard/wolfi-base", "ref": "cgr.dev/chainguard/wolfi-base:latest", "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4", "platform": "linux/amd64", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "stale", "versionsBehind": 1, "daysBehind": 5, "currentRef": "cgr.dev/chainguard/wolfi-base:latest", "currentDigest": "sha256:e2d3af72b200cd61e5413ca4b24d10c54b7bb1cd03e06395126bafd27dd34f89" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:ec30c1e0ccbc0778d7f7876619faf6d397a3367641c5c87ff37cddd051b23b9e", "timestamp": "2026-10-17T11:58:09Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:18142b85f08aa520b6f1c90edd27d7682c1e7965f9aaa5bf47ea3eb126cac494", "timestamp": "2026-10-17T11:58:23Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:3eb929b77b5675c1d23fd28de33611bcac047e0cbde031a3f1a6ce0dad2b539e", "timestamp": "2026-10-17T11:58:27Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:72d36efaeb45a587aa8470c85a2015688d3cf94e1ba324ebec85381e8ad1e89f", "timestamp": "2026-10-17T11:58:37Z" }, "recipe": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/recipe/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:3fd7e2bfcc9fef671fe5f30a5271bcd62f7ffa9a67c637ac0e2bef9cb69d7efc", "timestamp": "2026-10-17T11:58:19Z" }, "rebase": { "status": "not-applicable", "detail": "No rebase record: the image was built, not rebased." }, "tests": { "status": "present", "source": "recipe", "detail": "The verified recipe declares a smoke test (/bin/sh -c test \"$(id -u)\" = 65532 \u0026\u0026 test -s /etc/ssl/certs/ca-certificates.crt \u0026\u0026 test -e /usr/share/zoneinfo/UTC) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-17T11:58:01Z", "counts": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "fixable": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "findings": [] }, "reproducibility": { "status": "reproduced", "method": "recipe-rebuild", "checkedAt": "2026-10-17T12:01:25Z", "digest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb", "detail": "Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1", "workflow": "northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main", "job": "reproduce", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.2.0", "buildkit": "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:78055c70c3b661d38406de28dfa81bb2a663e08eb3c44dd247ce05cce616f108" }, "factory": { "kind": "Image", "name": "run-go", "version": "v0.2.0", "sourceDateEpoch": 1792108800, "inputs": { "packages": 22, "tools": 0, "images": 4 } }, "packages": 22, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] }, { "id": "run-node-24", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node", "tags": [ "24" ], "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c", "created": "2026-10-16T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:a7ca0c7cf9e485ab389370c8eebc2665b8c49367ba6e4751c388df7c9c01797a", "size": 61229998, "layers": 13 }, { "platform": "linux/arm64", "digest": "sha256:a836bb2566b2fe96ae1e0443e8c3cf8ee67969ac352909c6e6b4d792d9809b0d", "size": 58306957, "layers": 13 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory recipe" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-platform", "revision": "0131f755c5bff2c855db0583fe9501feb1fa4457", "basis": "provenance" }, "description": "Run image for Node.js 24 apps (stack node:1)", "base": { "repository": "cgr.dev/chainguard/wolfi-base", "ref": "cgr.dev/chainguard/wolfi-base:latest", "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4", "platform": "linux/amd64", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "stale", "versionsBehind": 1, "daysBehind": 5, "currentRef": "cgr.dev/chainguard/wolfi-base:latest", "currentDigest": "sha256:e2d3af72b200cd61e5413ca4b24d10c54b7bb1cd03e06395126bafd27dd34f89" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:3479868fdf34d69724302867036babe2e24b06304b48892f2345da59d3638ea6", "timestamp": "2026-10-17T11:58:40Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:362f2828fd869a0afa6dfe31f4e557e8fb40d497966402baac6153f4bf049e3a", "timestamp": "2026-10-17T11:58:53Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e6043e3c536d629cb5150ddd9154ee2c17120eee6a2cedeac491e5f99de4d226", "timestamp": "2026-10-17T11:58:57Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:2f0fb4e90d8d7c1ab9e2fc1a65fc2998868947f35ef70b50521fb8a4c64e97b7", "timestamp": "2026-10-17T11:59:08Z" }, "recipe": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/recipe/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:d747ec9ffb32218be1a005eaa9e9c9bb98c7f850213facdce5c47508e115dbfb", "timestamp": "2026-10-17T11:58:49Z" }, "rebase": { "status": "not-applicable", "detail": "No rebase record: the image was built, not rebased." }, "tests": { "status": "present", "source": "recipe", "detail": "The verified recipe declares a smoke test (/bin/sh -c test \"$(id -u)\" = 65532 \u0026\u0026 node -e \"console.log(process.version, process.versions.openssl)\") that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-17T11:58:27Z", "counts": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "fixable": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "findings": [] }, "reproducibility": { "status": "reproduced", "method": "recipe-rebuild", "checkedAt": "2026-10-17T12:01:47Z", "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c", "detail": "Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1", "workflow": "northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main", "job": "reproduce", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.2.0", "buildkit": "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:6fb9eed6496bd3fff091237c8e6e13c371ff322b9c3b9ff43a7ba62579662295" }, "factory": { "kind": "Image", "name": "run-node", "version": "v0.2.0", "sourceDateEpoch": 1792108800, "inputs": { "packages": 29, "tools": 0, "images": 4 } }, "packages": 29, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] }, { "id": "run-python-3-14", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python", "tags": [ "3.14" ], "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a", "created": "2026-10-16T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:0895de08547cb60ca80916041809522dd9328d8b1438f543641e213a925797ba", "size": 34079893, "layers": 13 }, { "platform": "linux/arm64", "digest": "sha256:cac385ea38fdce97a0970d60a228f9fa30d8439a1e0e8559accdc4cace03f3cb", "size": 31917845, "layers": 13 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory recipe" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-platform", "revision": "0131f755c5bff2c855db0583fe9501feb1fa4457", "basis": "provenance" }, "description": "Run image for Python 3.14 apps (stack python:1)", "base": { "repository": "cgr.dev/chainguard/wolfi-base", "ref": "cgr.dev/chainguard/wolfi-base:latest", "digest": "sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4", "platform": "linux/amd64", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "stale", "versionsBehind": 1, "daysBehind": 5, "currentRef": "cgr.dev/chainguard/wolfi-base:latest", "currentDigest": "sha256:e2d3af72b200cd61e5413ca4b24d10c54b7bb1cd03e06395126bafd27dd34f89" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:48f32a036d8e1dafc15c8209cc190bbc891b5ce88ccb273e7eadea667f785e71", "timestamp": "2026-10-17T11:58:15Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:ae43feea1a1c14e2d12630bdc3b52838cb940fa33a245936bd48b5b167599c43", "timestamp": "2026-10-17T11:58:27Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:bec8883a467f268e150f82bba01e2b7e3adcad9b49cb94970b3ed4019dc61a30", "timestamp": "2026-10-17T11:58:30Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:d49f536da871f41354e210ed7552f74cb143e33c0e0f4651847a3d3caa189094", "timestamp": "2026-10-17T11:58:39Z" }, "recipe": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/recipe/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:1b8c6cb1e4b3cb0c28fe4d5ac808c99cdd762ecdc48d51082a5dc3491df55176", "timestamp": "2026-10-17T11:58:23Z" }, "rebase": { "status": "not-applicable", "detail": "No rebase record: the image was built, not rebased." }, "tests": { "status": "present", "source": "recipe", "detail": "The verified recipe declares a smoke test (/bin/sh -c test \"$(id -u)\" = 65532 \u0026\u0026 python3 -c \"import ssl, sys; print(sys.version, ssl.OPENSSL_VERSION)\" \u0026\u0026 ls /usr/lib/libxml2.so.*) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-17T11:58:07Z", "counts": { "critical": 0, "high": 0, "medium": 1, "low": 0, "negligible": 0, "unknown": 0 }, "fixable": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "findings": [ { "id": "CVE-2025-15367", "severity": "medium", "package": "python-3.14", "version": "3.14.8_git20261014-r0", "platforms": [ "linux/amd64", "linux/arm64" ] } ] }, "reproducibility": { "status": "reproduced", "method": "recipe-rebuild", "checkedAt": "2026-10-17T12:01:34Z", "digest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a", "detail": "Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1", "workflow": "northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main", "job": "reproduce", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.2.0", "buildkit": "moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:74509a88a57cb3ba257137ae788084da05580d3a10fb6e9f56de16b5d62f0b28" }, "factory": { "kind": "Image", "name": "run-python", "version": "v0.2.0", "sourceDateEpoch": 1792108800, "inputs": { "packages": 39, "tools": 0, "images": 4 } }, "packages": 39, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] }, { "id": "storefront", "repository": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront", "tags": [ "latest" ], "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1", "created": "2026-10-16T00:00:00Z", "platforms": [ { "platform": "linux/amd64", "digest": "sha256:babca7f5be458a2d5952b3cae9953ff70407adbc46d9041e4834bed819cb786d", "size": 62841015, "layers": 14 }, { "platform": "linux/arm64", "digest": "sha256:d75f3433f1f909087d77923e176969159ec1c976cfac0a6c3cfedaae732291a1", "size": 59917974, "layers": 14 } ], "builder": { "kind": "clearcutt-factory", "basis": "clearcutt-factory rebase record" }, "source": { "url": "https://github.com/northcutted/clearcutt-showcase-storefront", "revision": "e91d6fc5d28498201cddea217fdbdf7485e8655b", "basis": "provenance" }, "description": "Storefront (Node.js 24 TypeScript, stack node:1)", "base": { "imageId": "run-node-24", "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node", "ref": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node:24", "digest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c", "provenOn": "linux/amd64", "method": "layer-prefix", "strength": "proof", "drift": "current", "versionsBehind": 0, "daysBehind": 0, "currentRef": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node:24", "currentDigest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c" }, "evidence": { "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-storefront", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:2db71d0fe60d04179c1e451bcfc9ed21d0ce3ffd970216abfab1abab506ec358", "timestamp": "2026-10-17T12:07:04Z" }, "sbom": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cyclonedx.org/bom", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-storefront", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:e3414265726bcc805278dd2ff1465af48afb73456fec02d6d13a89cf7c359932", "timestamp": "2026-10-17T12:07:18Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "vulnerabilityScan": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://cosign.sigstore.dev/attestation/vuln/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-storefront", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:db46dcad5905d28c2fe6e153881aad9615b9a46ae275e771ae05a0e346a95931", "timestamp": "2026-10-17T12:07:22Z", "platforms": { "linux/amd64": "verified", "linux/arm64": "verified" } }, "provenance": { "status": "verified", "source": "github-attestation", "predicateType": "https://slsa.dev/provenance/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-storefront", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/images.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8cd9da243e9daebae6414d7e75662bb4485fca7bde197fcab2bb68a5d8442954", "timestamp": "2026-10-17T12:15:36Z" }, "recipe": { "status": "not-applicable", "detail": "Rebased: the rebase record names the image that was built from a recipe." }, "rebase": { "status": "verified", "source": "cosign-attestation", "predicateType": "https://github.com/northcutted/clearcutt-factory/rebase/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-storefront", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:56f9f199ea0c22d45b0a45f2efcd7de244203b3bf1d9850d5057c22856e102eb", "timestamp": "2026-10-17T12:07:14Z" }, "tests": { "status": "missing", "detail": "No test attestation. The recipe of the image it was rebased from declares a smoke test (GET :8080/healthz), but the rebase record doesn't say whether the rebase ran it: clearcutt-factory runs the app's smoke test when it rebases from the app manifest (rebase -f, as its fleet workflow does), not when it rebases --image or with --no-test." } }, "vulnerabilities": { "source": "attestation", "scanner": "grype 0.118.0", "scannedAt": "2026-10-17T12:06:51Z", "counts": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "fixable": { "critical": 0, "high": 0, "medium": 0, "low": 0, "negligible": 0, "unknown": 0 }, "findings": [] }, "reproducibility": { "status": "reproduced", "method": "rebase-repeat", "checkedAt": "2026-10-17T12:07:40Z", "digest": "sha256:cd946e7df5b0f2ba610b7fb709d68dd9990d92154e1a6ca14f6b7dc08cdcedf1", "detail": "Reproduced from the rebase record verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-storefront/actions/runs/39031096208/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.", "source": "attestation", "builder": { "id": "https://github.com/northcutted/clearcutt-showcase-storefront/actions/runs/39031096208/attempts/1", "workflow": "northcutted/clearcutt-showcase-storefront/.github/workflows/factory.yml@refs/heads/main", "job": "rebase", "runner": "github-hosted", "os": "linux", "arch": "amd64", "factoryVersion": "v0.2.0" }, "signer": { "identity": "https://github.com/northcutted/clearcutt-factory/.github/workflows/fleet.yml@refs/tags/v0.2.0", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-storefront", "sourceRef": "refs/heads/main" }, "ref": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:93e795bbc91b07f54661fb3e5a0613dc1c776fcc39169a859b9f27452890e776" }, "factory": { "kind": "App", "name": "storefront", "stack": "node", "stackRef": "ghcr.io/northcutted/clearcutt-showcase/stacks/node:1", "stackDigest": "sha256:625c612fc15b8054e150d4b0bf4e0ec7cd382d476b1fb7338c92eb183765fe1e", "version": "v0.2.0", "rebasedFrom": "ghcr.io/northcutted/clearcutt-showcase/apps/storefront@sha256:8b1d4730bb6ad7d2a181533051fb327faf0b3fcc939f1fb13a90798b56e87f99" }, "packages": 81, "packagesSource": { "evidence": "sbom", "status": "verified", "platforms": [ "linux/amd64", "linux/arm64" ] }, "verdict": { "status": "verified", "reasons": [] }, "warnings": [] } ], "bases": [ { "repository": "cgr.dev/chainguard/wolfi-base", "currentRef": "cgr.dev/chainguard/wolfi-base:latest", "currentDigest": "sha256:e2d3af72b200cd61e5413ca4b24d10c54b7bb1cd03e06395126bafd27dd34f89", "currentPlatform": "linux/amd64", "versions": 1, "consumers": 6, "staleConsumers": 6 }, { "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go", "currentRef": "ghcr.io/northcutted/clearcutt-showcase/platform/run-go:1", "currentDigest": "sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb", "currentCreated": "2026-10-16T00:00:00Z", "versions": 1, "consumers": 1, "staleConsumers": 0 }, { "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node", "currentRef": "ghcr.io/northcutted/clearcutt-showcase/platform/run-node:24", "currentDigest": "sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c", "currentCreated": "2026-10-16T00:00:00Z", "versions": 1, "consumers": 1, "staleConsumers": 0 }, { "repository": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python", "currentRef": "ghcr.io/northcutted/clearcutt-showcase/platform/run-python:3.14", "currentDigest": "sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a", "currentCreated": "2026-10-16T00:00:00Z", "versions": 1, "consumers": 1, "staleConsumers": 0 } ], "stacks": [ { "repository": "ghcr.io/northcutted/clearcutt-showcase/stacks/go", "ref": "ghcr.io/northcutted/clearcutt-showcase/stacks/go:1", "currentDigest": "sha256:59ec0ee535b12f41f26f1cfcc5c5e44f400aa3609afe9dfa53974ebd1103da11", "versions": [ { "digest": "sha256:59ec0ee535b12f41f26f1cfcc5c5e44f400aa3609afe9dfa53974ebd1103da11", "current": true, "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/stacks/go@sha256:983465f5369ed3d5e604b8dca71e254bc261a9359954ff9b8eccbdcebe6e9f72", "timestamp": "2026-10-17T01:09:31Z" }, "images": [ "checkout" ] } ], "consumers": 1, "staleConsumers": 0 }, { "repository": "ghcr.io/northcutted/clearcutt-showcase/stacks/node", "ref": "ghcr.io/northcutted/clearcutt-showcase/stacks/node:1", "currentDigest": "sha256:625c612fc15b8054e150d4b0bf4e0ec7cd382d476b1fb7338c92eb183765fe1e", "versions": [ { "digest": "sha256:625c612fc15b8054e150d4b0bf4e0ec7cd382d476b1fb7338c92eb183765fe1e", "current": true, "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/stacks/node@sha256:1ab99514143f8be113bdf98772d7781e5c2134110158979c7b8956c38a33fe81", "timestamp": "2026-10-17T01:09:37Z" }, "images": [ "storefront" ] } ], "consumers": 1, "staleConsumers": 0 }, { "repository": "ghcr.io/northcutted/clearcutt-showcase/stacks/python", "ref": "ghcr.io/northcutted/clearcutt-showcase/stacks/python:1", "currentDigest": "sha256:27b0653b10d1f992706d4a530e8a852b2e36c18bd4ef109e4c58613d1bacc0fd", "versions": [ { "digest": "sha256:27b0653b10d1f992706d4a530e8a852b2e36c18bd4ef109e4c58613d1bacc0fd", "current": true, "signature": { "status": "verified", "source": "cosign-signature", "predicateType": "https://sigstore.dev/cosign/sign/v1", "signer": { "identity": "https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main", "issuer": "https://token.actions.githubusercontent.com", "sourceRepository": "https://github.com/northcutted/clearcutt-showcase-platform", "sourceRef": "refs/heads/main" }, "signerWorkflow": "github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml", "ref": "ghcr.io/northcutted/clearcutt-showcase/stacks/python@sha256:c38901a24cdfcb46ec6eea32b93547272ca5af7418893f347f895c59d50122b5", "timestamp": "2026-10-17T01:09:45Z" }, "images": [ "catalog" ] } ], "consumers": 1, "staleConsumers": 0 } ], "packages": [ { "name": "@fastify/ajv-compiler", "version": "4.0.7", "type": "npm", "purl": "pkg:npm/%40fastify/ajv-compiler@4.0.7", "images": [ "storefront" ] }, { "name": "@fastify/deepmerge", "version": "3.2.2", "type": "npm", "purl": "pkg:npm/%40fastify/deepmerge@3.2.2", "images": [ "storefront" ] }, { "name": "@fastify/error", "version": "4.2.1", "type": "npm", "purl": "pkg:npm/%40fastify/error@4.2.1", "images": [ "storefront" ] }, { "name": "@fastify/fast-json-stringify-compiler", "version": "5.1.1", "type": "npm", "purl": "pkg:npm/%40fastify/fast-json-stringify-compiler@5.1.1", "images": [ "storefront" ] }, { "name": "@fastify/forwarded", "version": "3.1.1", "type": "npm", "purl": "pkg:npm/%40fastify/forwarded@3.1.1", "images": [ "storefront" ] }, { "name": "@fastify/merge-json-schemas", "version": "0.2.2", "type": "npm", "purl": "pkg:npm/%40fastify/merge-json-schemas@0.2.2", "images": [ "storefront" ] }, { "name": "@fastify/proxy-addr", "version": "5.1.2", "type": "npm", "purl": "pkg:npm/%40fastify/proxy-addr@5.1.2", "images": [ "storefront" ] }, { "name": "@gar/promise-retry", "version": "1.0.3", "type": "npm", "purl": "pkg:npm/%40gar/promise-retry@1.0.3", "images": [ "build-node-24" ] }, { "name": "@isaacs/fs-minipass", "version": "4.0.1", "type": "npm", "purl": "pkg:npm/%40isaacs/fs-minipass@4.0.1", "images": [ "build-node-24" ] }, { "name": "@isaacs/string-locale-compare", "version": "1.1.0", "type": "npm", "purl": "pkg:npm/%40isaacs/string-locale-compare@1.1.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/agent", "version": "5.0.2", "type": "npm", "purl": "pkg:npm/%40npmcli/agent@5.0.2", "images": [ "build-node-24" ] }, { "name": "@npmcli/arborist", "version": "10.0.2", "type": "npm", "purl": "pkg:npm/%40npmcli/arborist@10.0.2", "images": [ "build-node-24" ] }, { "name": "@npmcli/config", "version": "11.0.1", "type": "npm", "purl": "pkg:npm/%40npmcli/config@11.0.1", "images": [ "build-node-24" ] }, { "name": "@npmcli/fs", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/fs@6.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/git", "version": "8.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/git@8.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/installed-package-contents", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/installed-package-contents@5.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/map-workspaces", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/map-workspaces@6.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/metavuln-calculator", "version": "10.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/metavuln-calculator@10.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/name-from-folder", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/name-from-folder@5.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/node-gyp", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/node-gyp@6.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/package-json", "version": "8.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/package-json@8.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/promise-spawn", "version": "10.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/promise-spawn@10.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/query", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/query@5.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/redact", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/redact@5.0.0", "images": [ "build-node-24" ] }, { "name": "@npmcli/run-script", "version": "11.0.0", "type": "npm", "purl": "pkg:npm/%40npmcli/run-script@11.0.0", "images": [ "build-node-24" ] }, { "name": "@pinojs/redact", "version": "0.4.0", "type": "npm", "purl": "pkg:npm/%40pinojs/redact@0.4.0", "images": [ "storefront" ] }, { "name": "@sigstore/bundle", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/%40sigstore/bundle@5.0.0", "images": [ "build-node-24" ] }, { "name": "@sigstore/core", "version": "4.0.1", "type": "npm", "purl": "pkg:npm/%40sigstore/core@4.0.1", "images": [ "build-node-24" ] }, { "name": "@sigstore/protobuf-specs", "version": "0.5.1", "type": "npm", "purl": "pkg:npm/%40sigstore/protobuf-specs@0.5.1", "images": [ "build-node-24" ] }, { "name": "@sigstore/sign", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/%40sigstore/sign@5.0.0", "images": [ "build-node-24" ] }, { "name": "@sigstore/tuf", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/%40sigstore/tuf@5.0.0", "images": [ "build-node-24" ] }, { "name": "@sigstore/verify", "version": "4.1.0", "type": "npm", "purl": "pkg:npm/%40sigstore/verify@4.1.0", "images": [ "build-node-24" ] }, { "name": "@tufjs/canonical-json", "version": "2.0.0", "type": "npm", "purl": "pkg:npm/%40tufjs/canonical-json@2.0.0", "images": [ "build-node-24" ] }, { "name": "@tufjs/models", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/%40tufjs/models@5.0.0", "images": [ "build-node-24" ] }, { "name": "abbrev", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/abbrev@5.0.0", "images": [ "build-node-24" ] }, { "name": "abstract-logging", "version": "2.0.1", "type": "npm", "purl": "pkg:npm/abstract-logging@2.0.1", "images": [ "storefront" ] }, { "name": "agent-base", "version": "9.0.0", "type": "npm", "purl": "pkg:npm/agent-base@9.0.0", "images": [ "build-node-24" ] }, { "name": "ajv", "version": "8.20.0", "type": "npm", "purl": "pkg:npm/ajv@8.20.0", "images": [ "storefront" ] }, { "name": "ajv-formats", "version": "3.0.1", "type": "npm", "purl": "pkg:npm/ajv-formats@3.0.1", "images": [ "storefront" ] }, { "name": "anyio", "version": "4.15.1", "type": "pypi", "purl": "pkg:pypi/anyio@4.15.1", "images": [ "catalog" ] }, { "name": "apk-tools", "version": "2.14.10-r17", "type": "apk", "purl": "pkg:apk/wolfi/apk-tools@2.14.10-r17", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "aproba", "version": "2.1.0", "type": "npm", "purl": "pkg:npm/aproba@2.1.0", "images": [ "build-node-24" ] }, { "name": "archy", "version": "1.0.0", "type": "npm", "purl": "pkg:npm/archy@1.0.0", "images": [ "build-node-24" ] }, { "name": "atomic-sleep", "version": "1.0.0", "type": "npm", "purl": "pkg:npm/atomic-sleep@1.0.0", "images": [ "storefront" ] }, { "name": "autocommand", "version": "2.2.2", "type": "pypi", "purl": "pkg:pypi/autocommand@2.2.2", "images": [ "build-python-3-14" ] }, { "name": "avvio", "version": "9.3.1", "type": "npm", "purl": "pkg:npm/avvio@9.3.1", "images": [ "storefront" ] }, { "name": "backports-tarfile", "version": "1.2.0", "type": "pypi", "purl": "pkg:pypi/backports-tarfile@1.2.0", "images": [ "build-python-3-14" ] }, { "name": "balanced-match", "version": "4.0.4", "type": "npm", "purl": "pkg:npm/balanced-match@4.0.4", "images": [ "build-node-24" ] }, { "name": "benchmark", "version": "1.0.0", "type": "npm", "purl": "pkg:npm/benchmark@1.0.0", "images": [ "storefront" ] }, { "name": "benchmarks", "version": "1.0.0", "type": "npm", "purl": "pkg:npm/benchmarks@1.0.0", "images": [ "storefront" ] }, { "name": "bin-links", "version": "7.0.0", "type": "npm", "purl": "pkg:npm/bin-links@7.0.0", "images": [ "build-node-24" ] }, { "name": "binary-extensions", "version": "3.1.0", "type": "npm", "purl": "pkg:npm/binary-extensions@3.1.0", "images": [ "build-node-24" ] }, { "name": "binutils", "version": "2.47-r1", "type": "apk", "purl": "pkg:apk/wolfi/binutils@2.47-r1", "images": [ "build-python-3-14" ] }, { "name": "brace-expansion", "version": "5.0.8", "type": "npm", "purl": "pkg:npm/brace-expansion@5.0.8", "images": [ "build-node-24" ] }, { "name": "build-base", "version": "1-r10", "type": "apk", "purl": "pkg:apk/wolfi/build-base@1-r10", "images": [ "build-python-3-14" ] }, { "name": "busybox", "version": "1.38.0-r3", "type": "apk", "purl": "pkg:apk/wolfi/busybox@1.38.0-r3", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "c-ares", "version": "1.34.8-r4", "type": "apk", "purl": "pkg:apk/wolfi/c-ares@1.34.8-r4", "images": [ "build-node-24", "run-node-24", "storefront" ] }, { "name": "ca-certificates-bundle", "version": "20260909-r2", "type": "apk", "purl": "pkg:apk/wolfi/ca-certificates-bundle@20260909-r2", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "cacache", "version": "21.0.1", "type": "npm", "purl": "pkg:npm/cacache@21.0.1", "images": [ "build-node-24" ] }, { "name": "catalog", "version": "1.0.0", "type": "pypi", "purl": "pkg:pypi/catalog@1.0.0", "images": [ "catalog" ] }, { "name": "chalk", "version": "5.6.2", "type": "npm", "purl": "pkg:npm/chalk@5.6.2", "images": [ "build-node-24" ] }, { "name": "chownr", "version": "3.0.0", "type": "npm", "purl": "pkg:npm/chownr@3.0.0", "images": [ "build-node-24" ] }, { "name": "ci-info", "version": "4.4.0", "type": "npm", "purl": "pkg:npm/ci-info@4.4.0", "images": [ "build-node-24" ] }, { "name": "cidr-regex", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/cidr-regex@6.0.0", "images": [ "build-node-24" ] }, { "name": "click", "version": "8.5.0", "type": "pypi", "purl": "pkg:pypi/click@8.5.0", "images": [ "catalog" ] }, { "name": "cmd-shim", "version": "9.0.2", "type": "npm", "purl": "pkg:npm/cmd-shim@9.0.2", "images": [ "build-node-24" ] }, { "name": "cmd/asm", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/asm", "images": [ "build-go-1" ] }, { "name": "cmd/cgo", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/cgo", "images": [ "build-go-1" ] }, { "name": "cmd/compile", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/compile", "images": [ "build-go-1" ] }, { "name": "cmd/cover", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/cover", "images": [ "build-go-1" ] }, { "name": "cmd/fix", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/fix", "images": [ "build-go-1" ] }, { "name": "cmd/go", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/go", "images": [ "build-go-1" ] }, { "name": "cmd/gofmt", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/gofmt", "images": [ "build-go-1" ] }, { "name": "cmd/link", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/link", "images": [ "build-go-1" ] }, { "name": "cmd/preprofile", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/preprofile", "images": [ "build-go-1" ] }, { "name": "cmd/vet", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/cmd/vet", "images": [ "build-go-1" ] }, { "name": "common-ancestor-path", "version": "2.0.0", "type": "npm", "purl": "pkg:npm/common-ancestor-path@2.0.0", "images": [ "build-node-24" ] }, { "name": "cookie", "version": "2.0.1", "type": "npm", "purl": "pkg:npm/cookie@2.0.1", "images": [ "storefront" ] }, { "name": "cssesc", "version": "3.0.0", "type": "npm", "purl": "pkg:npm/cssesc@3.0.0", "images": [ "build-node-24" ] }, { "name": "cyrus-sasl-heimdal-libs", "version": "2.1.28-r58", "type": "apk", "purl": "pkg:apk/wolfi/cyrus-sasl-heimdal-libs@2.1.28-r58", "images": [ "build-go-1" ] }, { "name": "debug", "version": "4.4.3", "type": "npm", "purl": "pkg:npm/debug@4.4.3", "images": [ "build-node-24" ] }, { "name": "dequal", "version": "2.0.3", "type": "npm", "purl": "pkg:npm/dequal@2.0.3", "images": [ "storefront" ] }, { "name": "diff", "version": "8.0.4", "type": "npm", "purl": "pkg:npm/diff@8.0.4", "images": [ "build-node-24" ] }, { "name": "env-paths", "version": "2.2.1", "type": "npm", "purl": "pkg:npm/env-paths@2.2.1", "images": [ "build-node-24" ] }, { "name": "exponential-backoff", "version": "3.1.3", "type": "npm", "purl": "pkg:npm/exponential-backoff@3.1.3", "images": [ "build-node-24" ] }, { "name": "fast-decode-uri-component", "version": "1.0.1", "type": "npm", "purl": "pkg:npm/fast-decode-uri-component@1.0.1", "images": [ "storefront" ] }, { "name": "fast-deep-equal", "version": "3.1.3", "type": "npm", "purl": "pkg:npm/fast-deep-equal@3.1.3", "images": [ "storefront" ] }, { "name": "fast-json-stringify", "version": "7.1.0", "type": "npm", "purl": "pkg:npm/fast-json-stringify@7.1.0", "images": [ "storefront" ] }, { "name": "fast-querystring", "version": "1.1.2", "type": "npm", "purl": "pkg:npm/fast-querystring@1.1.2", "images": [ "storefront" ] }, { "name": "fast-uri", "version": "3.1.8", "type": "npm", "purl": "pkg:npm/fast-uri@3.1.8", "images": [ "storefront" ] }, { "name": "fast-uri", "version": "4.2.2", "type": "npm", "purl": "pkg:npm/fast-uri@4.2.2", "images": [ "storefront" ] }, { "name": "fastest-levenshtein", "version": "1.0.16", "type": "npm", "purl": "pkg:npm/fastest-levenshtein@1.0.16", "images": [ "build-node-24" ] }, { "name": "fastify", "version": "5.12.7", "type": "npm", "purl": "pkg:npm/fastify@5.12.7", "images": [ "storefront" ] }, { "name": "fastq", "version": "1.20.3", "type": "npm", "purl": "pkg:npm/fastq@1.20.3", "images": [ "storefront" ] }, { "name": "fdir", "version": "6.5.0", "type": "npm", "purl": "pkg:npm/fdir@6.5.0", "images": [ "build-node-24" ] }, { "name": "find-my-way", "version": "9.10.0", "type": "npm", "purl": "pkg:npm/find-my-way@9.10.0", "images": [ "storefront" ] }, { "name": "fs-minipass", "version": "3.0.3", "type": "npm", "purl": "pkg:npm/fs-minipass@3.0.3", "images": [ "build-node-24" ] }, { "name": "gcc", "version": "16.2.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/gcc@16.2.0-r1", "images": [ "build-python-3-14" ] }, { "name": "gdbm", "version": "1.26-r7", "type": "apk", "purl": "pkg:apk/wolfi/gdbm@1.26-r7", "images": [ "build-go-1", "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "git", "version": "2.56.0-r2", "type": "apk", "purl": "pkg:apk/wolfi/git@2.56.0-r2", "images": [ "build-go-1" ] }, { "name": "github.com/go-chi/chi/v5", "version": "v5.2.3", "type": "golang", "purl": "pkg:golang/github.com/go-chi/chi/v5@v5.2.3", "images": [ "checkout" ] }, { "name": "github.com/google/uuid", "version": "v1.6.0", "type": "golang", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "images": [ "checkout" ] }, { "name": "github.com/northcutted/clearcutt-showcase-checkout", "version": "UNKNOWN", "type": "golang", "purl": "pkg:golang/github.com/northcutted/clearcutt-showcase-checkout", "images": [ "checkout" ] }, { "name": "glibc-2.44", "version": "2.44-r8", "type": "apk", "purl": "pkg:apk/wolfi/glibc-2.44@2.44-r8", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "glibc-2.44-locale-posix", "version": "2.44-r8", "type": "apk", "purl": "pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r8", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "glibc-dev", "version": "2.43-r13", "type": "apk", "purl": "pkg:apk/wolfi/glibc-dev@2.43-r13", "images": [ "build-python-3-14" ] }, { "name": "glob", "version": "13.0.6", "type": "npm", "purl": "pkg:npm/glob@13.0.6", "images": [ "build-node-24" ] }, { "name": "gmp", "version": "6.3.0-r10", "type": "apk", "purl": "pkg:apk/wolfi/gmp@6.3.0-r10", "images": [ "build-python-3-14" ] }, { "name": "go-1.27", "version": "1.27.2-r0", "type": "apk", "purl": "pkg:apk/wolfi/go-1.27@1.27.2-r0", "images": [ "build-go-1" ] }, { "name": "graceful-fs", "version": "4.2.11", "type": "npm", "purl": "pkg:npm/graceful-fs@4.2.11", "images": [ "build-node-24" ] }, { "name": "h11", "version": "0.16.0", "type": "pypi", "purl": "pkg:pypi/h11@0.16.0", "images": [ "catalog" ] }, { "name": "heimdal-libs", "version": "7.8.0-r54", "type": "apk", "purl": "pkg:apk/wolfi/heimdal-libs@7.8.0-r54", "images": [ "build-go-1" ] }, { "name": "hosted-git-info", "version": "10.1.1", "type": "npm", "purl": "pkg:npm/hosted-git-info@10.1.1", "images": [ "build-node-24" ] }, { "name": "http-cache-semantics", "version": "4.2.0", "type": "npm", "purl": "pkg:npm/http-cache-semantics@4.2.0", "images": [ "build-node-24" ] }, { "name": "http-proxy-agent", "version": "9.1.0", "type": "npm", "purl": "pkg:npm/http-proxy-agent@9.1.0", "images": [ "build-node-24" ] }, { "name": "https-proxy-agent", "version": "9.1.0", "type": "npm", "purl": "pkg:npm/https-proxy-agent@9.1.0", "images": [ "build-node-24" ] }, { "name": "iconv-lite", "version": "0.7.3", "type": "npm", "purl": "pkg:npm/iconv-lite@0.7.3", "images": [ "build-node-24" ] }, { "name": "icu78-data-full", "version": "78.3-r4", "type": "apk", "purl": "pkg:apk/wolfi/icu78-data-full@78.3-r4", "images": [ "build-node-24", "run-node-24", "storefront" ] }, { "name": "idna", "version": "3.20", "type": "pypi", "purl": "pkg:pypi/idna@3.20", "images": [ "catalog" ] }, { "name": "ignore-walk", "version": "9.0.0", "type": "npm", "purl": "pkg:npm/ignore-walk@9.0.0", "images": [ "build-node-24" ] }, { "name": "importlib-metadata", "version": "8.7.1", "type": "pypi", "purl": "pkg:pypi/importlib-metadata@8.7.1", "images": [ "build-python-3-14" ] }, { "name": "ini", "version": "7.0.0", "type": "npm", "purl": "pkg:npm/ini@7.0.0", "images": [ "build-node-24" ] }, { "name": "init-package-json", "version": "9.0.0", "type": "npm", "purl": "pkg:npm/init-package-json@9.0.0", "images": [ "build-node-24" ] }, { "name": "ip-address", "version": "10.2.0", "type": "npm", "purl": "pkg:npm/ip-address@10.2.0", "images": [ "build-node-24" ] }, { "name": "ipaddr.js", "version": "2.5.0", "type": "npm", "purl": "pkg:npm/ipaddr.js@2.5.0", "images": [ "storefront" ] }, { "name": "is-cidr", "version": "7.0.0", "type": "npm", "purl": "pkg:npm/is-cidr@7.0.0", "images": [ "build-node-24" ] }, { "name": "isexe", "version": "4.0.0", "type": "npm", "purl": "pkg:npm/isexe@4.0.0", "images": [ "build-node-24" ] }, { "name": "isl", "version": "0.28-r4", "type": "apk", "purl": "pkg:apk/wolfi/isl@0.28-r4", "images": [ "build-python-3-14" ] }, { "name": "jaraco-context", "version": "6.1.0", "type": "pypi", "purl": "pkg:pypi/jaraco-context@6.1.0", "images": [ "build-python-3-14" ] }, { "name": "jaraco-functools", "version": "4.4.0", "type": "pypi", "purl": "pkg:pypi/jaraco-functools@4.4.0", "images": [ "build-python-3-14" ] }, { "name": "jaraco-text", "version": "4.0.0", "type": "pypi", "purl": "pkg:pypi/jaraco-text@4.0.0", "images": [ "build-python-3-14" ] }, { "name": "json-parse-even-better-errors", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/json-parse-even-better-errors@6.0.0", "images": [ "build-node-24" ] }, { "name": "json-schema-ref-resolver", "version": "3.0.1", "type": "npm", "purl": "pkg:npm/json-schema-ref-resolver@3.0.1", "images": [ "storefront" ] }, { "name": "json-schema-traverse", "version": "1.0.0", "type": "npm", "purl": "pkg:npm/json-schema-traverse@1.0.0", "images": [ "storefront" ] }, { "name": "json-stringify-nice", "version": "1.1.4", "type": "npm", "purl": "pkg:npm/json-stringify-nice@1.1.4", "images": [ "build-node-24" ] }, { "name": "jsonparse", "version": "1.3.1", "type": "npm", "purl": "pkg:npm/jsonparse@1.3.1", "images": [ "build-node-24" ] }, { "name": "just-diff", "version": "6.0.2", "type": "npm", "purl": "pkg:npm/just-diff@6.0.2", "images": [ "build-node-24" ] }, { "name": "just-diff-apply", "version": "5.5.0", "type": "npm", "purl": "pkg:npm/just-diff-apply@5.5.0", "images": [ "build-node-24" ] }, { "name": "keyutils-libs", "version": "1.6.3-r41", "type": "apk", "purl": "pkg:apk/wolfi/keyutils-libs@1.6.3-r41", "images": [ "build-go-1" ] }, { "name": "krb5-conf", "version": "1.0-r10", "type": "apk", "purl": "pkg:apk/wolfi/krb5-conf@1.0-r10", "images": [ "build-go-1" ] }, { "name": "krb5-libs", "version": "1.22.2-r5", "type": "apk", "purl": "pkg:apk/wolfi/krb5-libs@1.22.2-r5", "images": [ "build-go-1" ] }, { "name": "ld-linux-2.44", "version": "2.44-r8", "type": "apk", "purl": "pkg:apk/wolfi/ld-linux-2.44@2.44-r8", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libatomic", "version": "16.2.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/libatomic@16.2.0-r1", "images": [ "build-python-3-14" ] }, { "name": "libbrotlicommon1", "version": "1.2.0-r6", "type": "apk", "purl": "pkg:apk/wolfi/libbrotlicommon1@1.2.0-r6", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libbrotlidec1", "version": "1.2.0-r6", "type": "apk", "purl": "pkg:apk/wolfi/libbrotlidec1@1.2.0-r6", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libbrotlienc1", "version": "1.2.0-r6", "type": "apk", "purl": "pkg:apk/wolfi/libbrotlienc1@1.2.0-r6", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libbz2-1", "version": "1.0.8-r25", "type": "apk", "purl": "pkg:apk/wolfi/libbz2-1@1.0.8-r25", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "libcom_err", "version": "1.47.4-r3", "type": "apk", "purl": "pkg:apk/wolfi/libcom_err@1.47.4-r3", "images": [ "build-go-1" ] }, { "name": "libcrypt1-2.44", "version": "2.44-r8", "type": "apk", "purl": "pkg:apk/wolfi/libcrypt1-2.44@2.44-r8", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libcrypto3", "version": "3.6.5-r2", "type": "apk", "purl": "pkg:apk/wolfi/libcrypto3@3.6.5-r2", "images": [ "build-go-1", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libcurl-openssl4", "version": "8.23.0-r0", "type": "apk", "purl": "pkg:apk/wolfi/libcurl-openssl4@8.23.0-r0", "images": [ "build-go-1" ] }, { "name": "libexpat1", "version": "2.9.0-r0", "type": "apk", "purl": "pkg:apk/wolfi/libexpat1@2.9.0-r0", "images": [ "build-go-1", "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "libffi", "version": "3.8.0-r2", "type": "apk", "purl": "pkg:apk/wolfi/libffi@3.8.0-r2", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "libgcc", "version": "16.2.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/libgcc@16.2.0-r1", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libgomp", "version": "16.2.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/libgomp@16.2.0-r1", "images": [ "build-python-3-14" ] }, { "name": "libicu78", "version": "78.3-r4", "type": "apk", "purl": "pkg:apk/wolfi/libicu78@78.3-r4", "images": [ "build-node-24", "run-node-24", "storefront" ] }, { "name": "libidn2", "version": "2.3.8-r10", "type": "apk", "purl": "pkg:apk/wolfi/libidn2@2.3.8-r10", "images": [ "build-go-1" ] }, { "name": "libldap-2.6", "version": "2.6.14-r0", "type": "apk", "purl": "pkg:apk/wolfi/libldap-2.6@2.6.14-r0", "images": [ "build-go-1" ] }, { "name": "libnghttp2-14", "version": "1.70.0-r5", "type": "apk", "purl": "pkg:apk/wolfi/libnghttp2-14@1.70.0-r5", "images": [ "build-go-1", "build-node-24", "run-node-24", "storefront" ] }, { "name": "libnpmaccess", "version": "11.0.0", "type": "npm", "purl": "pkg:npm/libnpmaccess@11.0.0", "images": [ "build-node-24" ] }, { "name": "libnpmdiff", "version": "9.0.2", "type": "npm", "purl": "pkg:npm/libnpmdiff@9.0.2", "images": [ "build-node-24" ] }, { "name": "libnpmexec", "version": "11.0.2", "type": "npm", "purl": "pkg:npm/libnpmexec@11.0.2", "images": [ "build-node-24" ] }, { "name": "libnpmfund", "version": "8.0.2", "type": "npm", "purl": "pkg:npm/libnpmfund@8.0.2", "images": [ "build-node-24" ] }, { "name": "libnpmorg", "version": "9.0.0", "type": "npm", "purl": "pkg:npm/libnpmorg@9.0.0", "images": [ "build-node-24" ] }, { "name": "libnpmpack", "version": "10.0.2", "type": "npm", "purl": "pkg:npm/libnpmpack@10.0.2", "images": [ "build-node-24" ] }, { "name": "libnpmpublish", "version": "12.0.0", "type": "npm", "purl": "pkg:npm/libnpmpublish@12.0.0", "images": [ "build-node-24" ] }, { "name": "libnpmsearch", "version": "10.0.0", "type": "npm", "purl": "pkg:npm/libnpmsearch@10.0.0", "images": [ "build-node-24" ] }, { "name": "libnpmteam", "version": "9.0.0", "type": "npm", "purl": "pkg:npm/libnpmteam@9.0.0", "images": [ "build-node-24" ] }, { "name": "libnpmversion", "version": "9.0.0", "type": "npm", "purl": "pkg:npm/libnpmversion@9.0.0", "images": [ "build-node-24" ] }, { "name": "libpcre2-8-0", "version": "10.49-r1", "type": "apk", "purl": "pkg:apk/wolfi/libpcre2-8-0@10.49-r1", "images": [ "build-go-1" ] }, { "name": "libpsl", "version": "0.23.3-r2", "type": "apk", "purl": "pkg:apk/wolfi/libpsl@0.23.3-r2", "images": [ "build-go-1" ] }, { "name": "libquadmath", "version": "16.2.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/libquadmath@16.2.0-r1", "images": [ "build-python-3-14" ] }, { "name": "libssl3", "version": "3.6.5-r2", "type": "apk", "purl": "pkg:apk/wolfi/libssl3@3.6.5-r2", "images": [ "build-go-1", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libstdc++", "version": "16.2.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/libstdc%2B%2B@16.2.0-r1", "images": [ "build-node-24", "build-python-3-14", "catalog", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libstdc++-dev", "version": "16.2.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/libstdc%2B%2B-dev@16.2.0-r1", "images": [ "build-python-3-14" ] }, { "name": "libunistring", "version": "1.4.2-r4", "type": "apk", "purl": "pkg:apk/wolfi/libunistring@1.4.2-r4", "images": [ "build-go-1" ] }, { "name": "libuuid", "version": "2.42.4-r0", "type": "apk", "purl": "pkg:apk/wolfi/libuuid@2.42.4-r0", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "libuv", "version": "1.53.0-r0", "type": "apk", "purl": "pkg:apk/wolfi/libuv@1.53.0-r0", "images": [ "build-node-24", "run-node-24", "storefront" ] }, { "name": "libverto", "version": "0.3.2-r9", "type": "apk", "purl": "pkg:apk/wolfi/libverto@0.3.2-r9", "images": [ "build-go-1" ] }, { "name": "libxcrypt", "version": "4.5.2-r6", "type": "apk", "purl": "pkg:apk/wolfi/libxcrypt@4.5.2-r6", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "libxcrypt-dev", "version": "4.5.2-r6", "type": "apk", "purl": "pkg:apk/wolfi/libxcrypt-dev@4.5.2-r6", "images": [ "build-python-3-14" ] }, { "name": "libxml2-16", "version": "2.15.4-r1", "type": "apk", "purl": "pkg:apk/wolfi/libxml2-16@2.15.4-r1", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "libxml2-dev", "version": "2.15.4-r1", "type": "apk", "purl": "pkg:apk/wolfi/libxml2-dev@2.15.4-r1", "images": [ "build-python-3-14" ] }, { "name": "libxml2-utils", "version": "2.15.4-r1", "type": "apk", "purl": "pkg:apk/wolfi/libxml2-utils@2.15.4-r1", "images": [ "build-python-3-14" ] }, { "name": "libzstd1", "version": "1.5.7-r10", "type": "apk", "purl": "pkg:apk/wolfi/libzstd1@1.5.7-r10", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "light-my-request", "version": "6.8.0", "type": "npm", "purl": "pkg:npm/light-my-request@6.8.0", "images": [ "storefront" ] }, { "name": "linux-headers", "version": "7.2.11-r0", "type": "apk", "purl": "pkg:apk/wolfi/linux-headers@7.2.11-r0", "images": [ "build-python-3-14" ] }, { "name": "lru-cache", "version": "11.5.2", "type": "npm", "purl": "pkg:npm/lru-cache@11.5.2", "images": [ "build-node-24" ] }, { "name": "make", "version": "4.4.1-r15", "type": "apk", "purl": "pkg:apk/wolfi/make@4.4.1-r15", "images": [ "build-python-3-14" ] }, { "name": "make-fetch-happen", "version": "16.0.1", "type": "npm", "purl": "pkg:npm/make-fetch-happen@16.0.1", "images": [ "build-node-24" ] }, { "name": "minimatch", "version": "10.2.3", "type": "npm", "purl": "pkg:npm/minimatch@10.2.3", "images": [ "build-node-24" ] }, { "name": "minipass", "version": "3.3.6", "type": "npm", "purl": "pkg:npm/minipass@3.3.6", "images": [ "build-node-24" ] }, { "name": "minipass", "version": "7.1.3", "type": "npm", "purl": "pkg:npm/minipass@7.1.3", "images": [ "build-node-24" ] }, { "name": "minipass-collect", "version": "2.0.1", "type": "npm", "purl": "pkg:npm/minipass-collect@2.0.1", "images": [ "build-node-24" ] }, { "name": "minipass-fetch", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/minipass-fetch@6.0.0", "images": [ "build-node-24" ] }, { "name": "minipass-flush", "version": "1.0.6", "type": "npm", "purl": "pkg:npm/minipass-flush@1.0.6", "images": [ "build-node-24" ] }, { "name": "minipass-pipeline", "version": "1.2.4", "type": "npm", "purl": "pkg:npm/minipass-pipeline@1.2.4", "images": [ "build-node-24" ] }, { "name": "minipass-sized", "version": "2.0.0", "type": "npm", "purl": "pkg:npm/minipass-sized@2.0.0", "images": [ "build-node-24" ] }, { "name": "minizlib", "version": "3.1.0", "type": "npm", "purl": "pkg:npm/minizlib@3.1.0", "images": [ "build-node-24" ] }, { "name": "more-itertools", "version": "10.8.0", "type": "pypi", "purl": "pkg:pypi/more-itertools@10.8.0", "images": [ "build-python-3-14" ] }, { "name": "mpc", "version": "1.4.1-r1", "type": "apk", "purl": "pkg:apk/wolfi/mpc@1.4.1-r1", "images": [ "build-python-3-14" ] }, { "name": "mpdecimal", "version": "4.0.1-r4", "type": "apk", "purl": "pkg:apk/wolfi/mpdecimal@4.0.1-r4", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "mpfr", "version": "4.2.2-r3", "type": "apk", "purl": "pkg:apk/wolfi/mpfr@4.2.2-r3", "images": [ "build-python-3-14" ] }, { "name": "ms", "version": "2.1.3", "type": "npm", "purl": "pkg:npm/ms@2.1.3", "images": [ "build-node-24" ] }, { "name": "mute-stream", "version": "4.0.0", "type": "npm", "purl": "pkg:npm/mute-stream@4.0.0", "images": [ "build-node-24" ] }, { "name": "ncurses", "version": "6.6.20261010-r0", "type": "apk", "purl": "pkg:apk/wolfi/ncurses@6.6.20261010-r0", "images": [ "build-go-1", "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "ncurses-terminfo-base", "version": "6.6.20261010-r0", "type": "apk", "purl": "pkg:apk/wolfi/ncurses-terminfo-base@6.6.20261010-r0", "images": [ "build-go-1", "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "negotiator", "version": "1.0.0", "type": "npm", "purl": "pkg:npm/negotiator@1.0.0", "images": [ "build-node-24" ] }, { "name": "nghttp3", "version": "1.18.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/nghttp3@1.18.0-r1", "images": [ "build-go-1" ] }, { "name": "ngtcp2", "version": "1.25.0-r5", "type": "apk", "purl": "pkg:apk/wolfi/ngtcp2@1.25.0-r5", "images": [ "build-go-1" ] }, { "name": "node-gyp", "version": "13.1.0", "type": "npm", "purl": "pkg:npm/node-gyp@13.1.0", "images": [ "build-node-24" ] }, { "name": "node-gyp", "version": "13.1.0-r0", "type": "apk", "purl": "pkg:apk/wolfi/node-gyp@13.1.0-r0", "images": [ "build-node-24" ] }, { "name": "nodejs-24", "version": "24.22.0-r0", "type": "apk", "purl": "pkg:apk/wolfi/nodejs-24@24.22.0-r0", "images": [ "build-node-24", "run-node-24", "storefront" ] }, { "name": "nopt", "version": "10.0.1", "type": "npm", "purl": "pkg:npm/nopt@10.0.1", "images": [ "build-node-24" ] }, { "name": "npm", "version": "12.0.2", "type": "npm", "purl": "pkg:npm/npm@12.0.2", "images": [ "build-node-24" ] }, { "name": "npm", "version": "12.0.2-r0", "type": "apk", "purl": "pkg:apk/wolfi/npm@12.0.2-r0", "images": [ "build-node-24" ] }, { "name": "npm-audit-report", "version": "8.0.0", "type": "npm", "purl": "pkg:npm/npm-audit-report@8.0.0", "images": [ "build-node-24" ] }, { "name": "npm-bundled", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/npm-bundled@6.0.0", "images": [ "build-node-24" ] }, { "name": "npm-install-checks", "version": "9.0.0", "type": "npm", "purl": "pkg:npm/npm-install-checks@9.0.0", "images": [ "build-node-24" ] }, { "name": "npm-normalize-package-bin", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/npm-normalize-package-bin@6.0.0", "images": [ "build-node-24" ] }, { "name": "npm-package-arg", "version": "14.0.0", "type": "npm", "purl": "pkg:npm/npm-package-arg@14.0.0", "images": [ "build-node-24" ] }, { "name": "npm-packlist", "version": "11.3.0", "type": "npm", "purl": "pkg:npm/npm-packlist@11.3.0", "images": [ "build-node-24" ] }, { "name": "npm-pick-manifest", "version": "12.0.0", "type": "npm", "purl": "pkg:npm/npm-pick-manifest@12.0.0", "images": [ "build-node-24" ] }, { "name": "npm-profile", "version": "13.0.1", "type": "npm", "purl": "pkg:npm/npm-profile@13.0.1", "images": [ "build-node-24" ] }, { "name": "npm-registry-fetch", "version": "20.0.1", "type": "npm", "purl": "pkg:npm/npm-registry-fetch@20.0.1", "images": [ "build-node-24" ] }, { "name": "npm-user-validate", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/npm-user-validate@5.0.0", "images": [ "build-node-24" ] }, { "name": "nss-db", "version": "2.43-r13", "type": "apk", "purl": "pkg:apk/wolfi/nss-db@2.43-r13", "images": [ "build-python-3-14" ] }, { "name": "nss-hesiod", "version": "2.43-r13", "type": "apk", "purl": "pkg:apk/wolfi/nss-hesiod@2.43-r13", "images": [ "build-python-3-14" ] }, { "name": "on-exit-leak-free", "version": "2.1.2", "type": "npm", "purl": "pkg:npm/on-exit-leak-free@2.1.2", "images": [ "storefront" ] }, { "name": "openssf-compiler-options", "version": "20250904-r11", "type": "apk", "purl": "pkg:apk/wolfi/openssf-compiler-options@20250904-r11", "images": [ "build-python-3-14" ] }, { "name": "openssl-4.0-libcrypto", "version": "4.0.3-r7", "type": "apk", "purl": "pkg:apk/wolfi/openssl-4.0-libcrypto@4.0.3-r7", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "openssl-4.0-libssl", "version": "4.0.3-r7", "type": "apk", "purl": "pkg:apk/wolfi/openssl-4.0-libssl@4.0.3-r7", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "openssl-provider-legacy-allowed", "version": "4.0.3-r1", "type": "apk", "purl": "pkg:apk/wolfi/openssl-provider-legacy-allowed@4.0.3-r1", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "p-map", "version": "7.0.5", "type": "npm", "purl": "pkg:npm/p-map@7.0.5", "images": [ "build-node-24" ] }, { "name": "packaging", "version": "26.0", "type": "pypi", "purl": "pkg:pypi/packaging@26.0", "images": [ "build-python-3-14" ] }, { "name": "pacote", "version": "22.0.0", "type": "npm", "purl": "pkg:npm/pacote@22.0.0", "images": [ "build-node-24" ] }, { "name": "parse-conflict-json", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/parse-conflict-json@6.0.0", "images": [ "build-node-24" ] }, { "name": "path-scurry", "version": "2.0.2", "type": "npm", "purl": "pkg:npm/path-scurry@2.0.2", "images": [ "build-node-24" ] }, { "name": "picomatch", "version": "4.0.4", "type": "npm", "purl": "pkg:npm/picomatch@4.0.4", "images": [ "build-node-24" ] }, { "name": "picomatch", "version": "4.0.7", "type": "npm", "purl": "pkg:npm/picomatch@4.0.7", "images": [ "build-node-24" ] }, { "name": "pino", "version": "10.4.0", "type": "npm", "purl": "pkg:npm/pino@10.4.0", "images": [ "storefront" ] }, { "name": "pino-abstract-transport", "version": "3.0.0", "type": "npm", "purl": "pkg:npm/pino-abstract-transport@3.0.0", "images": [ "storefront" ] }, { "name": "pino-std-serializers", "version": "7.1.0", "type": "npm", "purl": "pkg:npm/pino-std-serializers@7.1.0", "images": [ "storefront" ] }, { "name": "pip", "version": "26.2.1", "type": "pypi", "purl": "pkg:pypi/pip@26.2.1", "images": [ "build-python-3-14" ] }, { "name": "pkgconf", "version": "3.0.9-r0", "type": "apk", "purl": "pkg:apk/wolfi/pkgconf@3.0.9-r0", "images": [ "build-python-3-14" ] }, { "name": "platformdirs", "version": "4.4.0", "type": "pypi", "purl": "pkg:pypi/platformdirs@4.4.0", "images": [ "build-python-3-14" ] }, { "name": "posix-cc-wrappers", "version": "2-r10", "type": "apk", "purl": "pkg:apk/wolfi/posix-cc-wrappers@2-r10", "images": [ "build-python-3-14" ] }, { "name": "postcss-selector-parser", "version": "7.1.4", "type": "npm", "purl": "pkg:npm/postcss-selector-parser@7.1.4", "images": [ "build-node-24" ] }, { "name": "proc-log", "version": "7.0.0", "type": "npm", "purl": "pkg:npm/proc-log@7.0.0", "images": [ "build-node-24" ] }, { "name": "process-warning", "version": "5.1.1", "type": "npm", "purl": "pkg:npm/process-warning@5.1.1", "images": [ "storefront" ] }, { "name": "proggy", "version": "4.0.0", "type": "npm", "purl": "pkg:npm/proggy@4.0.0", "images": [ "build-node-24" ] }, { "name": "promise-all-reject-late", "version": "1.0.1", "type": "npm", "purl": "pkg:npm/promise-all-reject-late@1.0.1", "images": [ "build-node-24" ] }, { "name": "promise-call-limit", "version": "3.0.2", "type": "npm", "purl": "pkg:npm/promise-call-limit@3.0.2", "images": [ "build-node-24" ] }, { "name": "promzard", "version": "4.0.0", "type": "npm", "purl": "pkg:npm/promzard@4.0.0", "images": [ "build-node-24" ] }, { "name": "proxy-agent-negotiate", "version": "1.1.0", "type": "npm", "purl": "pkg:npm/proxy-agent-negotiate@1.1.0", "images": [ "build-node-24" ] }, { "name": "py3-pip-wheel", "version": "26.2.1-r4", "type": "apk", "purl": "pkg:apk/wolfi/py3-pip-wheel@26.2.1-r4", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "py3.14-pip", "version": "26.2.1-r4", "type": "apk", "purl": "pkg:apk/wolfi/py3.14-pip@26.2.1-r4", "images": [ "build-python-3-14" ] }, { "name": "py3.14-pip-base", "version": "26.2.1-r4", "type": "apk", "purl": "pkg:apk/wolfi/py3.14-pip-base@26.2.1-r4", "images": [ "build-python-3-14" ] }, { "name": "py3.14-setuptools", "version": "84.0.0-r1", "type": "apk", "purl": "pkg:apk/wolfi/py3.14-setuptools@84.0.0-r1", "images": [ "build-python-3-14" ] }, { "name": "python-3.14", "version": "3.14.8_git20261014-r0", "type": "apk", "purl": "pkg:apk/wolfi/python-3.14@3.14.8_git20261014-r0", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "python-3.14-base", "version": "3.14.8_git20261014-r0", "type": "apk", "purl": "pkg:apk/wolfi/python-3.14-base@3.14.8_git20261014-r0", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "python-3.14-base-dev", "version": "3.14.8_git20261014-r0", "type": "apk", "purl": "pkg:apk/wolfi/python-3.14-base-dev@3.14.8_git20261014-r0", "images": [ "build-python-3-14" ] }, { "name": "python-3.14-dev", "version": "3.14.8_git20261014-r0", "type": "apk", "purl": "pkg:apk/wolfi/python-3.14-dev@3.14.8_git20261014-r0", "images": [ "build-python-3-14" ] }, { "name": "qrcode-terminal", "version": "0.12.0", "type": "npm", "purl": "pkg:npm/qrcode-terminal@0.12.0", "images": [ "build-node-24" ] }, { "name": "quick-format-unescaped", "version": "4.0.4", "type": "npm", "purl": "pkg:npm/quick-format-unescaped@4.0.4", "images": [ "storefront" ] }, { "name": "read", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/read@6.0.0", "images": [ "build-node-24" ] }, { "name": "read-cmd-shim", "version": "7.0.0", "type": "npm", "purl": "pkg:npm/read-cmd-shim@7.0.0", "images": [ "build-node-24" ] }, { "name": "readline", "version": "8.3-r3", "type": "apk", "purl": "pkg:apk/wolfi/readline@8.3-r3", "images": [ "build-go-1", "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "real-require", "version": "1.0.0", "type": "npm", "purl": "pkg:npm/real-require@1.0.0", "images": [ "storefront" ] }, { "name": "require-from-string", "version": "2.0.2", "type": "npm", "purl": "pkg:npm/require-from-string@2.0.2", "images": [ "storefront" ] }, { "name": "ret", "version": "0.5.0", "type": "npm", "purl": "pkg:npm/ret@0.5.0", "images": [ "storefront" ] }, { "name": "reusify", "version": "1.1.0", "type": "npm", "purl": "pkg:npm/reusify@1.1.0", "images": [ "storefront" ] }, { "name": "rfdc", "version": "1.4.1", "type": "npm", "purl": "pkg:npm/rfdc@1.4.1", "images": [ "storefront" ] }, { "name": "safe-regex2", "version": "5.1.2", "type": "npm", "purl": "pkg:npm/safe-regex2@5.1.2", "images": [ "storefront" ] }, { "name": "safe-stable-stringify", "version": "2.5.0", "type": "npm", "purl": "pkg:npm/safe-stable-stringify@2.5.0", "images": [ "storefront" ] }, { "name": "safer-buffer", "version": "2.1.2", "type": "npm", "purl": "pkg:npm/safer-buffer@2.1.2", "images": [ "build-node-24" ] }, { "name": "secure-json-parse", "version": "4.1.1", "type": "npm", "purl": "pkg:npm/secure-json-parse@4.1.1", "images": [ "storefront" ] }, { "name": "semver", "version": "7.8.5", "type": "npm", "purl": "pkg:npm/semver@7.8.5", "images": [ "build-node-24", "storefront" ] }, { "name": "set-cookie-parser", "version": "3.1.3", "type": "npm", "purl": "pkg:npm/set-cookie-parser@3.1.3", "images": [ "storefront" ] }, { "name": "setuptools", "version": "84.0.0", "type": "pypi", "purl": "pkg:pypi/setuptools@84.0.0", "images": [ "build-python-3-14" ] }, { "name": "signal-exit", "version": "4.1.0", "type": "npm", "purl": "pkg:npm/signal-exit@4.1.0", "images": [ "build-node-24" ] }, { "name": "sigstore", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/sigstore@5.0.0", "images": [ "build-node-24" ] }, { "name": "smart-buffer", "version": "4.2.0", "type": "npm", "purl": "pkg:npm/smart-buffer@4.2.0", "images": [ "build-node-24" ] }, { "name": "socks", "version": "2.8.9", "type": "npm", "purl": "pkg:npm/socks@2.8.9", "images": [ "build-node-24" ] }, { "name": "socks-proxy-agent", "version": "10.1.0", "type": "npm", "purl": "pkg:npm/socks-proxy-agent@10.1.0", "images": [ "build-node-24" ] }, { "name": "sonic-boom", "version": "4.2.1", "type": "npm", "purl": "pkg:npm/sonic-boom@4.2.1", "images": [ "storefront" ] }, { "name": "spdx-exceptions", "version": "2.5.0", "type": "npm", "purl": "pkg:npm/spdx-exceptions@2.5.0", "images": [ "build-node-24" ] }, { "name": "spdx-expression-parse", "version": "4.0.0", "type": "npm", "purl": "pkg:npm/spdx-expression-parse@4.0.0", "images": [ "build-node-24" ] }, { "name": "spdx-license-ids", "version": "3.0.23", "type": "npm", "purl": "pkg:npm/spdx-license-ids@3.0.23", "images": [ "build-node-24" ] }, { "name": "split2", "version": "4.2.0", "type": "npm", "purl": "pkg:npm/split2@4.2.0", "images": [ "storefront" ] }, { "name": "sqlite-libs", "version": "3.54.1-r0", "type": "apk", "purl": "pkg:apk/wolfi/sqlite-libs@3.54.1-r0", "images": [ "build-go-1", "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "ssri", "version": "14.0.0", "type": "npm", "purl": "pkg:npm/ssri@14.0.0", "images": [ "build-node-24" ] }, { "name": "starlette", "version": "1.8.0", "type": "pypi", "purl": "pkg:pypi/starlette@1.8.0", "images": [ "catalog" ] }, { "name": "stdlib", "version": "go1.27.2", "type": "golang", "purl": "pkg:golang/stdlib@1.27.2", "images": [ "build-go-1", "checkout" ] }, { "name": "storefront", "version": "1.0.0", "type": "npm", "purl": "pkg:npm/storefront@1.0.0", "images": [ "storefront" ] }, { "name": "supports-color", "version": "10.2.2", "type": "npm", "purl": "pkg:npm/supports-color@10.2.2", "images": [ "build-node-24" ] }, { "name": "tar", "version": "7.5.21", "type": "npm", "purl": "pkg:npm/tar@7.5.21", "images": [ "build-node-24" ] }, { "name": "tar", "version": "7.5.22", "type": "npm", "purl": "pkg:npm/tar@7.5.22", "images": [ "build-node-24" ] }, { "name": "text-table", "version": "0.2.0", "type": "npm", "purl": "pkg:npm/text-table@0.2.0", "images": [ "build-node-24" ] }, { "name": "thread-stream", "version": "4.2.0", "type": "npm", "purl": "pkg:npm/thread-stream@4.2.0", "images": [ "storefront" ] }, { "name": "tiny-relative-date", "version": "2.0.2", "type": "npm", "purl": "pkg:npm/tiny-relative-date@2.0.2", "images": [ "build-node-24" ] }, { "name": "tinyglobby", "version": "0.2.17", "type": "npm", "purl": "pkg:npm/tinyglobby@0.2.17", "images": [ "build-node-24" ] }, { "name": "toad-cache", "version": "3.7.4", "type": "npm", "purl": "pkg:npm/toad-cache@3.7.4", "images": [ "storefront" ] }, { "name": "tomli", "version": "2.4.0", "type": "pypi", "purl": "pkg:pypi/tomli@2.4.0", "images": [ "build-python-3-14" ] }, { "name": "transport", "version": "0.0.1", "type": "npm", "purl": "pkg:npm/transport@0.0.1", "images": [ "storefront" ] }, { "name": "treeverse", "version": "3.0.0", "type": "npm", "purl": "pkg:npm/treeverse@3.0.0", "images": [ "build-node-24" ] }, { "name": "tuf-js", "version": "6.0.0", "type": "npm", "purl": "pkg:npm/tuf-js@6.0.0", "images": [ "build-node-24" ] }, { "name": "typing-extensions", "version": "4.16.0", "type": "pypi", "purl": "pkg:pypi/typing-extensions@4.16.0", "images": [ "catalog" ] }, { "name": "tzdata", "version": "2026e-r0", "type": "apk", "purl": "pkg:apk/wolfi/tzdata@2026e-r0", "images": [ "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "undici", "version": "6.27.0", "type": "npm", "purl": "pkg:npm/undici@6.27.0", "images": [ "build-node-24" ] }, { "name": "undici", "version": "8.11.2", "type": "npm", "purl": "pkg:npm/undici@8.11.2", "images": [ "build-node-24" ] }, { "name": "util-deprecate", "version": "1.0.2", "type": "npm", "purl": "pkg:npm/util-deprecate@1.0.2", "images": [ "build-node-24" ] }, { "name": "uvicorn", "version": "0.54.0", "type": "pypi", "purl": "pkg:pypi/uvicorn@0.54.0", "images": [ "catalog" ] }, { "name": "validate-npm-package-name", "version": "8.0.0", "type": "npm", "purl": "pkg:npm/validate-npm-package-name@8.0.0", "images": [ "build-node-24" ] }, { "name": "walk-up-path", "version": "4.0.0", "type": "npm", "purl": "pkg:npm/walk-up-path@4.0.0", "images": [ "build-node-24" ] }, { "name": "wheel", "version": "0.46.3", "type": "pypi", "purl": "pkg:pypi/wheel@0.46.3", "images": [ "build-python-3-14" ] }, { "name": "which", "version": "7.0.0", "type": "npm", "purl": "pkg:npm/which@7.0.0", "images": [ "build-node-24" ] }, { "name": "wolfi-base", "version": "1-r7", "type": "apk", "purl": "pkg:apk/wolfi/wolfi-base@1-r7", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "wolfi-baselayout", "version": "20230201-r30", "type": "apk", "purl": "pkg:apk/wolfi/wolfi-baselayout@20230201-r30", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "wolfi-keys", "version": "1-r13", "type": "apk", "purl": "pkg:apk/wolfi/wolfi-keys@1-r13", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "write-file-atomic", "version": "8.0.0", "type": "npm", "purl": "pkg:npm/write-file-atomic@8.0.0", "images": [ "build-node-24" ] }, { "name": "xz", "version": "5.8.4-r0", "type": "apk", "purl": "pkg:apk/wolfi/xz@5.8.4-r0", "images": [ "build-python-3-14", "catalog", "run-python-3-14" ] }, { "name": "xz-dev", "version": "5.8.4-r0", "type": "apk", "purl": "pkg:apk/wolfi/xz-dev@5.8.4-r0", "images": [ "build-python-3-14" ] }, { "name": "yallist", "version": "4.0.0", "type": "npm", "purl": "pkg:npm/yallist@4.0.0", "images": [ "build-node-24" ] }, { "name": "yallist", "version": "5.0.0", "type": "npm", "purl": "pkg:npm/yallist@5.0.0", "images": [ "build-node-24" ] }, { "name": "zipp", "version": "3.23.0", "type": "pypi", "purl": "pkg:pypi/zipp@3.23.0", "images": [ "build-python-3-14" ] }, { "name": "zlib", "version": "1.3.2.1_rc20260921-r0", "type": "apk", "purl": "pkg:apk/wolfi/zlib@1.3.2.1_rc20260921-r0", "images": [ "build-go-1", "build-node-24", "build-python-3-14", "catalog", "checkout", "run-go-1", "run-node-24", "run-python-3-14", "storefront" ] }, { "name": "zlib-dev", "version": "1.3.2.1_rc20260921-r0", "type": "apk", "purl": "pkg:apk/wolfi/zlib-dev@1.3.2.1_rc20260921-r0", "images": [ "build-python-3-14" ] } ], "warnings": [] }