Image

build-python:3.14

ghcr.io/northcutted/clearcutt-showcase/platform/build-python

Build image for Python 3.14 apps (stack python:1)

Meets every requirement in the policy.

Identity

Digest: sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3
Tags: 3.14
Created: 2026-10-16 00:00 UTC
Built by: clearcutt-factory (clearcutt-factory recipe)
Source: https://github.com/northcutted/clearcutt-showcase-platform at 0131f755c5bff2c855db0583fe9501feb1fa4457 Read from build provenance that verified.
clearcutt-factory: Image build-python; built with v0.2.0; pins 65 packages, 0 tools, 4 images; files clamped to 2026-10-16

Base

Built on: cgr.dev/chainguard/wolfi-base:latest
sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4 (its linux/amd64 image)
How it's known: The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency: A newer version of its base was observed in this run. 1 version and 5 days behind
Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:e2d3af72b200 (its linux/amd64 image)
Measured against the newest version observed in this run, not against upstream.

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign signature	2026-10-17 12:00 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:4fff10f5656512c76db6ebaf5345ffb7c3aed0b0495fd590af81a639a9924f3a
SBOM	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 12:00 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:4a8573489faf09f5043c98e846fb632a2e83b09863e3b1f8ca3ab2a3e838c242
Vulnerability report	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 12:00 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:ccf50581564ce55c716261a0df1184c266a4102c4b1f0eae4bfec308ea33cd09
SLSA provenance	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	GitHub attestation	2026-10-17 12:00 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:417bac51154b19575fddc1b95e6e3639e033efd193eeebcc9f76ac5174960f54
Recipe	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 12:00 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:1bdff8a4246298c50660fa3659f7abae7e7d67dad05bf009b13e4e67c605d14e
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.	—	declared in the recipe	—	The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && python3 -m pip --version && cc --version && pkg-config --modversion libxml-2.0) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.

cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3

SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:c6d9785a97867ae6f822c3aec60d46b715dec192e67ea304b54844dbe69dd043

SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:7d8447ea012a97f2e15047705fbc6b1e7dbb4037132c8df58e6916e92ac102b1

Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:c6d9785a97867ae6f822c3aec60d46b715dec192e67ea304b54844dbe69dd043

Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:7d8447ea012a97f2e15047705fbc6b1e7dbb4037132c8df58e6916e92ac102b1

SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.

cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3

Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3

SLSA provenance (GitHub). Checks GitHub's artifact attestation with GitHub's own verifier, reading it from the registry: made by a workflow run in that repository, signed by that workflow.

gh attestation verify \
  oci://ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3 \
  --bundle-from-oci \
  --repo=northcutted/clearcutt-showcase-platform \
  --signer-workflow=github.com/northcutted/clearcutt-factory/.github/workflows/images.yml \
  --source-ref=refs/heads/main

Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman. clearcutt-factory takes no source-ref flag; the cosign commands above check the ref.

clearcutt-factory verify \
  --image=ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3 > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","vulnerabilityScan","provenance","recipe"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-platform","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-checkout","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-catalog","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-storefront","sourceRef":"refs/heads/main","sourceMatchesImage":true}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":7,"stackSigners":[{"identity":"https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main","issuer":"https://token.actions.githubusercontent.com"}]}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, gh attestation, clearcutt-factory, clearcutt-verify, as of clearcutt-verify v0.16.0, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-17 11:59 UTC, 1 day before this report. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

	critical	high	medium	low	negligible	unknown
Findings	0	0	1	0	0	0
With a fix	0	0	0	0	0	0

1 findings

ID	Package	Version	Severity	Fixed in	Platforms
CVE-2025-15367	python-3.14	3.14.8_git20261014-r0	medium	no fix known	linux/amd64, linux/arm64

Tests and rebuilds

Tests

The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && python3 -m pip --version && cc --version && pkg-config --modversion libxml-2.0) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Rebuild

Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-17 12:03 UTC

Rebuild gave sha256:59b29c2b0346e02eb0f2bd6d53b0d7719145f7d279e7fa31d0fe1a6c5fd03eb3, the same digest as the image.

Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.

Checked by a clearcutt-factory reproduction attestation, verified against a trusted signer; this run didn't rebuild it.

Attestation signed by https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0 (issuer https://token.actions.githubusercontent.com)

ghcr.io/northcutted/clearcutt-showcase/platform/build-python@sha256:020ba9c55fefde94323e1ed974ada204645a7dbe4b49cb64f0bc181d1f898fe6

Where it was reproduced, as the attestation says:

Run: https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1
Workflow northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main, job reproduce
Machine: github-hosted, linux/amd64
clearcutt-factory v0.2.0
BuildKit moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base
2026-10-19 07:41 UTC	`sha256:59b29c2b0346`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-19 01:05 UTC	`sha256:59b29c2b0346`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-19 01:02 UTC	`sha256:59b29c2b0346`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-19 00:27 UTC	`sha256:59b29c2b0346`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-19 00:20 UTC	`sha256:59b29c2b0346`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-18 14:29 UTC	`sha256:59b29c2b0346`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-18 14:11 UTC	`sha256:59b29c2b0346`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-18 14:10 UTC	`sha256:59b29c2b0346`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-18 07:25 UTC	`sha256:59b29c2b0346` base moved	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)
2026-10-17 14:43 UTC	`sha256:59b29c2b0346`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)
2026-10-17 14:38 UTC	`sha256:59b29c2b0346`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)
2026-10-17 14:06 UTC	`sha256:59b29c2b0346`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)
2026-10-17 14:03 UTC	`sha256:59b29c2b0346`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)
2026-10-17 12:20 UTC	`sha256:59b29c2b0346` rebuilt, same base	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)
2026-10-17 07:25 UTC	`sha256:6d1af765e4a7`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)
2026-10-17 03:58 UTC	`sha256:6d1af765e4a7` rebuilt, same base	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)
2026-10-17 01:19 UTC	`sha256:386492572620`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)

? means unknown: the run had no vulnerability data for this image.

Critical findings

High findings

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:c6d9785a97867ae6f822c3aec60d46b715dec192e67ea304b54844dbe69dd043`	12	215 MB
linux/arm64	`sha256:7d8447ea012a97f2e15047705fbc6b1e7dbb4037132c8df58e6916e92ac102b1`	12	203 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

79 package versions

Package	Version	Type
apk-tools	2.14.10-r17	apk
autocommand	2.2.2	pypi
backports-tarfile	1.2.0	pypi
binutils	2.47-r1	apk
build-base	1-r10	apk
busybox	1.38.0-r3	apk
ca-certificates-bundle	20260909-r2	apk
gcc	16.2.0-r1	apk
gdbm	1.26-r7	apk
glibc-2.44	2.44-r8	apk
glibc-2.44-locale-posix	2.44-r8	apk
glibc-dev	2.43-r13	apk
gmp	6.3.0-r10	apk
importlib-metadata	8.7.1	pypi
isl	0.28-r4	apk
jaraco-context	6.1.0	pypi
jaraco-functools	4.4.0	pypi
jaraco-text	4.0.0	pypi
ld-linux-2.44	2.44-r8	apk
libatomic	16.2.0-r1	apk
libbrotlicommon1	1.2.0-r6	apk
libbrotlidec1	1.2.0-r6	apk
libbrotlienc1	1.2.0-r6	apk
libbz2-1	1.0.8-r25	apk
libcrypt1-2.44	2.44-r8	apk
libexpat1	2.9.0-r0	apk
libffi	3.8.0-r2	apk
libgcc	16.2.0-r1	apk
libgomp	16.2.0-r1	apk
libquadmath	16.2.0-r1	apk
libstdc++	16.2.0-r1	apk
libstdc++-dev	16.2.0-r1	apk
libuuid	2.42.4-r0	apk
libxcrypt	4.5.2-r6	apk
libxcrypt-dev	4.5.2-r6	apk
libxml2-16	2.15.4-r1	apk
libxml2-dev	2.15.4-r1	apk
libxml2-utils	2.15.4-r1	apk
libzstd1	1.5.7-r10	apk
linux-headers	7.2.11-r0	apk
make	4.4.1-r15	apk
more-itertools	10.8.0	pypi
mpc	1.4.1-r1	apk
mpdecimal	4.0.1-r4	apk
mpfr	4.2.2-r3	apk
ncurses	6.6.20261010-r0	apk
ncurses-terminfo-base	6.6.20261010-r0	apk
nss-db	2.43-r13	apk
nss-hesiod	2.43-r13	apk
openssf-compiler-options	20250904-r11	apk
openssl-4.0-libcrypto	4.0.3-r7	apk
openssl-4.0-libssl	4.0.3-r7	apk
openssl-provider-legacy-allowed	4.0.3-r1	apk
packaging	26.0	pypi
pip	26.2.1	pypi
pkgconf	3.0.9-r0	apk
platformdirs	4.4.0	pypi
posix-cc-wrappers	2-r10	apk
py3-pip-wheel	26.2.1-r4	apk
py3.14-pip	26.2.1-r4	apk
py3.14-pip-base	26.2.1-r4	apk
py3.14-setuptools	84.0.0-r1	apk
python-3.14	3.14.8_git20261014-r0	apk
python-3.14-base	3.14.8_git20261014-r0	apk
python-3.14-base-dev	3.14.8_git20261014-r0	apk
python-3.14-dev	3.14.8_git20261014-r0	apk
readline	8.3-r3	apk
setuptools	84.0.0	pypi
sqlite-libs	3.54.1-r0	apk
tomli	2.4.0	pypi
wheel	0.46.3	pypi
wolfi-base	1-r7	apk
wolfi-baselayout	20230201-r30	apk
wolfi-keys	1-r13	apk
xz	5.8.4-r0	apk
xz-dev	5.8.4-r0	apk
zipp	3.23.0	pypi
zlib	1.3.2.1_rc20260921-r0	apk
zlib-dev	1.3.2.1_rc20260921-r0	apk