clearcutt-showcase estate
Image estate

Image

catalog:latest

ghcr.io/northcutted/clearcutt-showcase/apps/catalog

Catalog service (Python 3.14, stack python:1)

Meets every requirement in the policy.

Identity

Digest
sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf
Tags
latest
Created
2026-10-16 00:00 UTC
Built by
clearcutt-factory (clearcutt-factory recipe)
Source
https://github.com/northcutted/clearcutt-showcase-catalog at 52f7db821a38db1ca04ba0d5efe57845138d897e Read from build provenance that verified.
clearcutt-factory
App catalog; built with v0.2.0; pins 0 packages, 0 tools, 5 images; files clamped to 2026-10-16
Stack
python from the registry stack ghcr.io/northcutted/clearcutt-showcase/stacks/python:1, pinned at sha256:27b0653b10d1.
Version: Pinned to the version the stack's tag names now. · Signature: Found, and checked against a trusted signer in the policy. · Every version of this stack

Base

Built on
ghcr.io/northcutted/clearcutt-showcase/platform/run-python:3.14 (run-python:3.14)
sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a
How it's known
The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency
On the newest version of its base observed in this run.
Newest observed: ghcr.io/northcutted/clearcutt-showcase/platform/run-python:3.14 sha256:daf68a5f8a3b
Measured against the newest version observed in this run, not against upstream.

Evidence

EvidenceStatusSigned byFound asWhenDetail
Signature Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-catalog
cosign signature2026-10-17 12:14 UTC
ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:d4767eb9effe34e6759a0b6458813c47d595c0a0341992b9c72dc855d24933f5
SBOM Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-catalog
cosign attestation2026-10-17 12:14 UTC
  • Found, and checked against a trusted signer in the policy.
  • Found, and checked against a trusted signer in the policy.
ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:a375620caab2d3f30b31d54eabf62f09048622935dfeeb15cfb9628ccd634e14
Vulnerability report Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-catalog
cosign attestation2026-10-17 12:14 UTC
  • Found, and checked against a trusted signer in the policy.
  • Found, and checked against a trusted signer in the policy.
ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:43667050cbb33aa5ab45ddf3f387bea9e80c769e23431c698ce9374afea98d2a
SLSA provenance Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-catalog
GitHub attestation2026-10-17 12:15 UTC
ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:8ab676e3b9fbd6269d961de644e1d00293043e2d27f9492941ab32488f0d5ff8
Recipe Found, and checked against a trusted signer in the policy.https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0
issuer https://token.actions.githubusercontent.com
run in https://github.com/northcutted/clearcutt-showcase-catalog
cosign attestation2026-10-17 12:14 UTC
ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:e81a1dac27b6fc18a77f772f540872e329c0a5f0f1d4bfe136df2337f317970d
Rebase record Doesn't apply to this image.———No rebase record: the image was built, not rebased.
Tests The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.—declared in the recipe—The verified recipe declares a smoke test (GET :8080/healthz) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.
cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-catalog \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf
SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-catalog \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:f496f972939c87601e3b18c592deb925a84145ae53ebbbfa37f6106c89ca8d98
SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-catalog \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:59a07ba95e20a18ed123d2826d2ca55bf6a99ed3a57024c6ea852d36f8d37444
Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.
cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-catalog \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:f496f972939c87601e3b18c592deb925a84145ae53ebbbfa37f6106c89ca8d98
Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.
cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-catalog \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:59a07ba95e20a18ed123d2826d2ca55bf6a99ed3a57024c6ea852d36f8d37444
SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.
cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-catalog \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf
Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-catalog \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf
SLSA provenance (GitHub). Checks GitHub's artifact attestation with GitHub's own verifier, reading it from the registry: made by a workflow run in that repository, signed by that workflow.
gh attestation verify \
  oci://ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf \
  --bundle-from-oci \
  --repo=northcutted/clearcutt-showcase-catalog \
  --signer-workflow=github.com/northcutted/clearcutt-factory/.github/workflows/images.yml \
  --source-ref=refs/heads/main
Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman. clearcutt-factory takes no source-ref flag; the cosign commands above check the ref.
clearcutt-factory verify \
  --image=ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-catalog
Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.
cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","vulnerabilityScan","provenance","recipe"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-platform","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-checkout","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-catalog","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-storefront","sourceRef":"refs/heads/main","sourceMatchesImage":true}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":7,"stackSigners":[{"identity":"https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main","issuer":"https://token.actions.githubusercontent.com"}]}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, gh attestation, clearcutt-factory, clearcutt-verify, as of clearcutt-verify v0.16.0, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-17 12:14 UTC, 1 day before this report. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

criticalhighmediumlownegligibleunknown
Findings001000
With a fix000000
1 findings
IDPackageVersionSeverityFixed inPlatforms
CVE-2025-15367python-3.143.14.8_git20261014-r0mediumno fix knownlinux/amd64, linux/arm64

Tests and rebuilds

Tests
The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (GET :8080/healthz) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.
Rebuild
Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-17 12:16 UTC
Rebuild gave sha256:53c76ac7c0e9fd5eee41d8423b3d7801c11abdb7a2604d8f884e637b59be9cdf, the same digest as the image.
Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-catalog/actions/runs/39031596076/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.
Checked by a clearcutt-factory reproduction attestation, verified against a trusted signer; this run didn't rebuild it.
Attestation signed by https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0 (issuer https://token.actions.githubusercontent.com)
ghcr.io/northcutted/clearcutt-showcase/apps/catalog@sha256:aa7568e12ad405bfe8dfcf75d837780f0df3ae885cc5774e6d1bf052b21aef13
Where it was reproduced, as the attestation says:

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
RunDigestVerdictBaseCriticalHigh
2026-10-19 07:41 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-19 01:05 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-19 01:02 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-19 00:27 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-19 00:20 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-18 14:29 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-18 14:11 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-18 14:10 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-18 07:25 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-17 14:43 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-17 14:38 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-17 14:06 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-17 14:03 UTCsha256:53c76ac7c0e9 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-17 12:20 UTCsha256:53c76ac7c0e9
rebuilt on a new base
 Verified Proven, current
sha256:daf68a5f8a3b
00
2026-10-17 07:25 UTCsha256:b5944261ebe6 Verified Proven, current
sha256:4844ef0efd83
422
2026-10-17 03:58 UTCsha256:b5944261ebe6
rebuilt on a new base
 Verified Proven, current
sha256:4844ef0efd83
422
2026-10-17 01:19 UTCsha256:15bf287835f1 Verified Proven, current
sha256:db399d4a7592
00

? means unknown: the run had no vulnerability data for this image.

Critical findings
502026-10-172026-10-192026-10-17 01:19 UTC: 02026-10-17 03:58 UTC: 42026-10-17 07:25 UTC: 42026-10-17 12:20 UTC: 02026-10-17 14:03 UTC: 02026-10-17 14:06 UTC: 02026-10-17 14:38 UTC: 02026-10-17 14:43 UTC: 02026-10-18 07:25 UTC: 02026-10-18 14:10 UTC: 02026-10-18 14:11 UTC: 02026-10-18 14:29 UTC: 02026-10-19 00:20 UTC: 02026-10-19 00:27 UTC: 02026-10-19 01:02 UTC: 02026-10-19 01:05 UTC: 02026-10-19 07:41 UTC: 00
High findings
5002026-10-172026-10-192026-10-17 01:19 UTC: 02026-10-17 03:58 UTC: 222026-10-17 07:25 UTC: 222026-10-17 12:20 UTC: 02026-10-17 14:03 UTC: 02026-10-17 14:06 UTC: 02026-10-17 14:38 UTC: 02026-10-17 14:43 UTC: 02026-10-18 07:25 UTC: 02026-10-18 14:10 UTC: 02026-10-18 14:11 UTC: 02026-10-18 14:29 UTC: 02026-10-19 00:20 UTC: 02026-10-19 00:27 UTC: 02026-10-19 01:02 UTC: 02026-10-19 01:05 UTC: 02026-10-19 07:41 UTC: 00

Platforms

PlatformDigestLayersCompressed size
linux/amd64sha256:f496f972939c87601e3b18c592deb925a84145ae53ebbbfa37f6106c89ca8d981433 MB
linux/arm64sha256:59a07ba95e20a18ed123d2826d2ca55bf6a99ed3a57024c6ea852d36f8d374441431 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

47 package versions
PackageVersionType
anyio4.15.1pypi
apk-tools2.14.10-r17apk
busybox1.38.0-r3apk
ca-certificates-bundle20260909-r2apk
catalog1.0.0pypi
click8.5.0pypi
gdbm1.26-r7apk
glibc-2.442.44-r8apk
glibc-2.44-locale-posix2.44-r8apk
h110.16.0pypi
idna3.20pypi
ld-linux-2.442.44-r8apk
libbrotlicommon11.2.0-r6apk
libbrotlidec11.2.0-r6apk
libbrotlienc11.2.0-r6apk
libbz2-11.0.8-r25apk
libcrypt1-2.442.44-r8apk
libcrypto33.6.5-r2apk
libexpat12.9.0-r0apk
libffi3.8.0-r2apk
libgcc16.2.0-r1apk
libssl33.6.5-r2apk
libstdc++16.2.0-r1apk
libuuid2.42.4-r0apk
libxcrypt4.5.2-r6apk
libxml2-162.15.4-r1apk
libzstd11.5.7-r10apk
mpdecimal4.0.1-r4apk
ncurses6.6.20261010-r0apk
ncurses-terminfo-base6.6.20261010-r0apk
openssl-4.0-libcrypto4.0.3-r7apk
openssl-4.0-libssl4.0.3-r7apk
openssl-provider-legacy-allowed4.0.3-r1apk
py3-pip-wheel26.2.1-r4apk
python-3.143.14.8_git20261014-r0apk
python-3.14-base3.14.8_git20261014-r0apk
readline8.3-r3apk
sqlite-libs3.54.1-r0apk
starlette1.8.0pypi
typing-extensions4.16.0pypi
tzdata2026e-r0apk
uvicorn0.54.0pypi
wolfi-base1-r7apk
wolfi-baselayout20230201-r30apk
wolfi-keys1-r13apk
xz5.8.4-r0apk
zlib1.3.2.1_rc20260921-r0apk