clearcutt-showcase estate
Image estate

Image

build-go:1

ghcr.io/northcutted/clearcutt-showcase/platform/build-go

Build image for Go apps (stack go:1)

Meets every requirement in the policy.

Identity

Digest
sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2
Tags
1
Created
2026-10-16 00:00 UTC
Built by
clearcutt-factory (clearcutt-factory recipe)
Source
https://github.com/northcutted/clearcutt-showcase-platform at ab3eb4f659ee317a65e39b28550c705ce089f34c Read from build provenance that verified.
clearcutt-factory
Image build-go; built with v0.3.0; pins 45 packages, 0 tools, 4 images; files clamped to 2026-10-16

Base

Built on
cgr.dev/chainguard/wolfi-base:latest
sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4 (its linux/amd64 image)
How it's known
The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency
A newer version of its base was observed in this run. 1 version and 5 days behind
Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:e2d3af72b200 (its linux/amd64 image)
Measured against the newest version observed in this run, not against upstream.

Evidence

EvidenceStatusSigned byFound asWhenDetail
Signature Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
cosign signature2026-10-17 13:51 UTC
ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:afc0e015e511d24c31730d6106ac76357f962e0166033f7096bf2565d3b9ff0e
SBOM Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
cosign attestation2026-10-17 13:52 UTC
  • Found, and checked against a trusted signer in the policy.
  • Found, and checked against a trusted signer in the policy.
ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:1786fed1cd80e15d22126c0edcea16efa8a74027b43925ca236cf2a87b9b3600
Vulnerability report Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
cosign attestation2026-10-17 13:52 UTC
  • Found, and checked against a trusted signer in the policy.
  • Found, and checked against a trusted signer in the policy.
ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:dfcf2ad3e794abfcbd4c72c0a527e5464812ad75d4a1d772e4eb12169d698f34
SLSA provenance Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
GitHub attestation2026-10-17 13:52 UTC
ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:09280d70967164e3cf098c8523910d7f6d30d6ad5c4fe83fd2cd12e029d2e561
Recipe Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-platform
cosign attestation2026-10-17 13:52 UTC
ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:77bf32621e84966bd4a7f6facc3bfe548f3517e5d54b34ae7e4a6cfc2c6ee1b9
Rebase record Doesn't apply to this image.———No rebase record: the image was built, not rebased.
Tests The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.—declared in the recipe—The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && go version && git --version) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.
cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2
SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:383d16a2b8430d1ffebaab0eef20ceeb63aaf6dc5cfb23c33919ab194cb34e2d
SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:5cbc804fcad6f3582de7ea535a3f7769223b544acbbaba8168012b7ac9ee07a4
Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.
cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:383d16a2b8430d1ffebaab0eef20ceeb63aaf6dc5cfb23c33919ab194cb34e2d
Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.
cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:5cbc804fcad6f3582de7ea535a3f7769223b544acbbaba8168012b7ac9ee07a4
SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.
cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2
Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2
SLSA provenance (GitHub). Checks GitHub's artifact attestation with GitHub's own verifier, reading it from the registry: made by a workflow run in that repository, signed by that workflow.
gh attestation verify \
  oci://ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2 \
  --bundle-from-oci \
  --repo=northcutted/clearcutt-showcase-platform \
  --signer-workflow=github.com/northcutted/clearcutt-factory/.github/workflows/images.yml \
  --source-ref=refs/heads/main
Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman. clearcutt-factory takes no source-ref flag; the cosign commands above check the ref.
clearcutt-factory verify \
  --image=ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform
Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.
cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2 > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","vulnerabilityScan","provenance","recipe"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-platform","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-checkout","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-catalog","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-storefront","sourceRef":"refs/heads/main","sourceMatchesImage":true}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":7,"stackSigners":[{"identity":"https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main","issuer":"https://token.actions.githubusercontent.com"}]}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, gh attestation, clearcutt-factory, clearcutt-verify, as of clearcutt-verify v0.16.0, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-17 13:51 UTC, 1 day before this report. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

criticalhighmediumlownegligibleunknown
Findings000000
With a fix000000

No findings.

Tests and rebuilds

Tests
The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && go version && git --version) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.
Rebuild
Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-17 13:55 UTC
Rebuild gave sha256:b0c904822c6b1d6054c881b0bb6ffc8aa812067e5361863aaf6d787852e62bf2, the same digest as the image.
Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39038127661/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.
Checked by a clearcutt-factory reproduction attestation, verified against a trusted signer; this run didn't rebuild it.
Attestation signed by https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.3.0 (issuer https://token.actions.githubusercontent.com)
ghcr.io/northcutted/clearcutt-showcase/platform/build-go@sha256:bcc929680e320a4b4a43811b9a19ac38eaaa9e40f4843e61bcb9bcddf311ec0b
Where it was reproduced, as the attestation says:

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
RunDigestVerdictBaseCriticalHigh
2026-10-19 07:41 UTCsha256:b0c904822c6b Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-19 01:05 UTCsha256:b0c904822c6b Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-19 01:02 UTCsha256:b0c904822c6b Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-19 00:27 UTCsha256:b0c904822c6b Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-19 00:20 UTCsha256:b0c904822c6b Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-18 14:29 UTCsha256:b0c904822c6b Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-18 14:11 UTCsha256:b0c904822c6b Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-18 14:10 UTCsha256:b0c904822c6b Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-18 07:25 UTCsha256:b0c904822c6b
base moved
 Verified Proven, stale
sha256:030e45cb3718 (linux/amd64)
00
2026-10-17 14:43 UTCsha256:b0c904822c6b Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
00
2026-10-17 14:38 UTCsha256:b0c904822c6b Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
00
2026-10-17 14:06 UTCsha256:b0c904822c6b Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
00
2026-10-17 14:03 UTCsha256:b0c904822c6b
rebuilt, same base
 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
00
2026-10-17 12:20 UTCsha256:bed8ceec67c5 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
00
2026-10-17 07:25 UTCsha256:bed8ceec67c5 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
00
2026-10-17 03:58 UTCsha256:bed8ceec67c5 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
00
2026-10-17 01:19 UTCsha256:bed8ceec67c5 Verified Proven, current
sha256:030e45cb3718 (linux/amd64)
00

? means unknown: the run had no vulnerability data for this image.

Critical findings
102026-10-172026-10-192026-10-17 01:19 UTC: 02026-10-17 03:58 UTC: 02026-10-17 07:25 UTC: 02026-10-17 12:20 UTC: 02026-10-17 14:03 UTC: 02026-10-17 14:06 UTC: 02026-10-17 14:38 UTC: 02026-10-17 14:43 UTC: 02026-10-18 07:25 UTC: 02026-10-18 14:10 UTC: 02026-10-18 14:11 UTC: 02026-10-18 14:29 UTC: 02026-10-19 00:20 UTC: 02026-10-19 00:27 UTC: 02026-10-19 01:02 UTC: 02026-10-19 01:05 UTC: 02026-10-19 07:41 UTC: 00
High findings
102026-10-172026-10-192026-10-17 01:19 UTC: 02026-10-17 03:58 UTC: 02026-10-17 07:25 UTC: 02026-10-17 12:20 UTC: 02026-10-17 14:03 UTC: 02026-10-17 14:06 UTC: 02026-10-17 14:38 UTC: 02026-10-17 14:43 UTC: 02026-10-18 07:25 UTC: 02026-10-18 14:10 UTC: 02026-10-18 14:11 UTC: 02026-10-18 14:29 UTC: 02026-10-19 00:20 UTC: 02026-10-19 00:27 UTC: 02026-10-19 01:02 UTC: 02026-10-19 01:05 UTC: 02026-10-19 07:41 UTC: 00

Platforms

PlatformDigestLayersCompressed size
linux/amd64sha256:383d16a2b8430d1ffebaab0eef20ceeb63aaf6dc5cfb23c33919ab194cb34e2d1284 MB
linux/arm64sha256:5cbc804fcad6f3582de7ea535a3f7769223b544acbbaba8168012b7ac9ee07a41278 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

56 package versions
PackageVersionType
apk-tools2.14.10-r17apk
busybox1.38.0-r3apk
ca-certificates-bundle20260909-r2apk
cmd/asmUNKNOWNgolang
cmd/cgoUNKNOWNgolang
cmd/compileUNKNOWNgolang
cmd/coverUNKNOWNgolang
cmd/fixUNKNOWNgolang
cmd/goUNKNOWNgolang
cmd/gofmtUNKNOWNgolang
cmd/linkUNKNOWNgolang
cmd/preprofileUNKNOWNgolang
cmd/vetUNKNOWNgolang
cyrus-sasl-heimdal-libs2.1.28-r58apk
gdbm1.26-r7apk
git2.56.0-r2apk
glibc-2.442.44-r8apk
glibc-2.44-locale-posix2.44-r8apk
go-1.271.27.2-r0apk
heimdal-libs7.8.0-r54apk
keyutils-libs1.6.3-r41apk
krb5-conf1.0-r10apk
krb5-libs1.22.2-r5apk
ld-linux-2.442.44-r8apk
libbrotlicommon11.2.0-r6apk
libbrotlidec11.2.0-r6apk
libbrotlienc11.2.0-r6apk
libcom_err1.47.4-r3apk
libcrypt1-2.442.44-r8apk
libcrypto33.6.5-r2apk
libcurl-openssl48.23.0-r0apk
libexpat12.9.0-r0apk
libgcc16.2.0-r1apk
libidn22.3.8-r10apk
libldap-2.62.6.14-r0apk
libnghttp2-141.70.0-r5apk
libpcre2-8-010.49-r1apk
libpsl0.23.3-r2apk
libssl33.6.5-r2apk
libunistring1.4.2-r4apk
libverto0.3.2-r9apk
libxcrypt4.5.2-r6apk
ncurses6.6.20261010-r0apk
ncurses-terminfo-base6.6.20261010-r0apk
nghttp31.18.0-r1apk
ngtcp21.25.0-r5apk
openssl-4.0-libcrypto4.0.3-r7apk
openssl-4.0-libssl4.0.3-r7apk
openssl-provider-legacy-allowed4.0.3-r1apk
readline8.3-r3apk
sqlite-libs3.54.1-r0apk
stdlibgo1.27.2golang
wolfi-base1-r7apk
wolfi-baselayout20230201-r30apk
wolfi-keys1-r13apk
zlib1.3.2.1_rc20260921-r0apk