Image

run-go:1

ghcr.io/northcutted/clearcutt-showcase/platform/run-go

Run image for Go apps (stack go:1)

Meets every requirement in the policy.

Identity

Digest: sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb
Tags: 1
Created: 2026-10-16 00:00 UTC
Built by: clearcutt-factory (clearcutt-factory recipe)
Source: https://github.com/northcutted/clearcutt-showcase-platform at 0131f755c5bff2c855db0583fe9501feb1fa4457 Read from build provenance that verified.
clearcutt-factory: Image run-go; built with v0.2.0; pins 22 packages, 0 tools, 4 images; files clamped to 2026-10-16

Base

Built on: cgr.dev/chainguard/wolfi-base:latest
sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4 (its linux/amd64 image)
How it's known: The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency: A newer version of its base was observed in this run. 1 version and 5 days behind
Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:e2d3af72b200 (its linux/amd64 image)
Measured against the newest version observed in this run, not against upstream.

Built on this image: checkout:latest

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign signature	2026-10-17 11:58 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:ec30c1e0ccbc0778d7f7876619faf6d397a3367641c5c87ff37cddd051b23b9e
SBOM	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:18142b85f08aa520b6f1c90edd27d7682c1e7965f9aaa5bf47ea3eb126cac494
Vulnerability report	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:3eb929b77b5675c1d23fd28de33611bcac047e0cbde031a3f1a6ce0dad2b539e
SLSA provenance	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	GitHub attestation	2026-10-17 11:58 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:72d36efaeb45a587aa8470c85a2015688d3cf94e1ba324ebec85381e8ad1e89f
Recipe	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:3fd7e2bfcc9fef671fe5f30a5271bcd62f7ffa9a67c637ac0e2bef9cb69d7efc
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.	—	declared in the recipe	—	The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && test -s /etc/ssl/certs/ca-certificates.crt && test -e /usr/share/zoneinfo/UTC) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.

cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb

SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:31fcb9452084b7946efc3ea9ee3bb64046634174d4716fef39ac5560b888a69e

SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:71befe80e15b6f565294297a06412610b6124a301c5bc7816aba53569edfbfe1

Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:31fcb9452084b7946efc3ea9ee3bb64046634174d4716fef39ac5560b888a69e

Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:71befe80e15b6f565294297a06412610b6124a301c5bc7816aba53569edfbfe1

SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.

cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb

Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb

SLSA provenance (GitHub). Checks GitHub's artifact attestation with GitHub's own verifier, reading it from the registry: made by a workflow run in that repository, signed by that workflow.

gh attestation verify \
  oci://ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb \
  --bundle-from-oci \
  --repo=northcutted/clearcutt-showcase-platform \
  --signer-workflow=github.com/northcutted/clearcutt-factory/.github/workflows/images.yml \
  --source-ref=refs/heads/main

Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman. clearcutt-factory takes no source-ref flag; the cosign commands above check the ref.

clearcutt-factory verify \
  --image=ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","vulnerabilityScan","provenance","recipe"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-platform","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-checkout","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-catalog","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-storefront","sourceRef":"refs/heads/main","sourceMatchesImage":true}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":7,"stackSigners":[{"identity":"https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main","issuer":"https://token.actions.githubusercontent.com"}]}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, gh attestation, clearcutt-factory, clearcutt-verify, as of clearcutt-verify v0.16.0, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-17 11:58 UTC, 1 day before this report. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

	critical	high	medium	low	negligible	unknown
Findings	0	0	0	0	0	0
With a fix	0	0	0	0	0	0

No findings.

Tests and rebuilds

Tests

The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && test -s /etc/ssl/certs/ca-certificates.crt && test -e /usr/share/zoneinfo/UTC) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Rebuild

Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-17 12:01 UTC

Rebuild gave sha256:f6a0ee0f0f63221790ea8664f922fc836ab28b2e978e53a2623f47a66cbc0fdb, the same digest as the image.

Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.

Checked by a clearcutt-factory reproduction attestation, verified against a trusted signer; this run didn't rebuild it.

Attestation signed by https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0 (issuer https://token.actions.githubusercontent.com)

ghcr.io/northcutted/clearcutt-showcase/platform/run-go@sha256:78055c70c3b661d38406de28dfa81bb2a663e08eb3c44dd247ce05cce616f108

Where it was reproduced, as the attestation says:

Run: https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1
Workflow northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main, job reproduce
Machine: github-hosted, linux/amd64
clearcutt-factory v0.2.0
BuildKit moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base	Critical	High
2026-10-19 07:41 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 01:05 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 01:02 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 00:27 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 00:20 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:29 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:11 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:10 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 07:25 UTC	`sha256:f6a0ee0f0f63` base moved	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:43 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:38 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:06 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:03 UTC	`sha256:f6a0ee0f0f63`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 12:20 UTC	`sha256:f6a0ee0f0f63` rebuilt, same base	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 07:25 UTC	`sha256:48499cde6a17`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	4	22
2026-10-17 03:58 UTC	`sha256:48499cde6a17` rebuilt, same base	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	4	22
2026-10-17 01:19 UTC	`sha256:3f495a2e2d26`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0

? means unknown: the run had no vulnerability data for this image.

Critical findings

High findings

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:31fcb9452084b7946efc3ea9ee3bb64046634174d4716fef39ac5560b888a69e`	13	14 MB
linux/arm64	`sha256:71befe80e15b6f565294297a06412610b6124a301c5bc7816aba53569edfbfe1`	13	12 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

22 package versions

Package	Version	Type
apk-tools	2.14.10-r17	apk
busybox	1.38.0-r3	apk
ca-certificates-bundle	20260909-r2	apk
glibc-2.44	2.44-r8	apk
glibc-2.44-locale-posix	2.44-r8	apk
ld-linux-2.44	2.44-r8	apk
libbrotlicommon1	1.2.0-r6	apk
libbrotlidec1	1.2.0-r6	apk
libbrotlienc1	1.2.0-r6	apk
libcrypt1-2.44	2.44-r8	apk
libcrypto3	3.6.5-r2	apk
libgcc	16.2.0-r1	apk
libssl3	3.6.5-r2	apk
libxcrypt	4.5.2-r6	apk
openssl-4.0-libcrypto	4.0.3-r7	apk
openssl-4.0-libssl	4.0.3-r7	apk
openssl-provider-legacy-allowed	4.0.3-r1	apk
tzdata	2026e-r0	apk
wolfi-base	1-r7	apk
wolfi-baselayout	20230201-r30	apk
wolfi-keys	1-r13	apk
zlib	1.3.2.1_rc20260921-r0	apk