Image

run-node:24

ghcr.io/northcutted/clearcutt-showcase/platform/run-node

Run image for Node.js 24 apps (stack node:1)

Meets every requirement in the policy.

Identity

Digest: sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c
Tags: 24
Created: 2026-10-16 00:00 UTC
Built by: clearcutt-factory (clearcutt-factory recipe)
Source: https://github.com/northcutted/clearcutt-showcase-platform at 0131f755c5bff2c855db0583fe9501feb1fa4457 Read from build provenance that verified.
clearcutt-factory: Image run-node; built with v0.2.0; pins 29 packages, 0 tools, 4 images; files clamped to 2026-10-16

Base

Built on: cgr.dev/chainguard/wolfi-base:latest
sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4 (its linux/amd64 image)
How it's known: The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency: A newer version of its base was observed in this run. 1 version and 5 days behind
Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:e2d3af72b200 (its linux/amd64 image)
Measured against the newest version observed in this run, not against upstream.

Built on this image: storefront:latest

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign signature	2026-10-17 11:58 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:3479868fdf34d69724302867036babe2e24b06304b48892f2345da59d3638ea6
SBOM	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:362f2828fd869a0afa6dfe31f4e557e8fb40d497966402baac6153f4bf049e3a
Vulnerability report	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e6043e3c536d629cb5150ddd9154ee2c17120eee6a2cedeac491e5f99de4d226
SLSA provenance	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	GitHub attestation	2026-10-17 11:59 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:2f0fb4e90d8d7c1ab9e2fc1a65fc2998868947f35ef70b50521fb8a4c64e97b7
Recipe	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:d747ec9ffb32218be1a005eaa9e9c9bb98c7f850213facdce5c47508e115dbfb
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.	—	declared in the recipe	—	The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && node -e "console.log(process.version, process.versions.openssl)") that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.

cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c

SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:a7ca0c7cf9e485ab389370c8eebc2665b8c49367ba6e4751c388df7c9c01797a

SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:a836bb2566b2fe96ae1e0443e8c3cf8ee67969ac352909c6e6b4d792d9809b0d

Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:a7ca0c7cf9e485ab389370c8eebc2665b8c49367ba6e4751c388df7c9c01797a

Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:a836bb2566b2fe96ae1e0443e8c3cf8ee67969ac352909c6e6b4d792d9809b0d

SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.

cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c

Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c

SLSA provenance (GitHub). Checks GitHub's artifact attestation with GitHub's own verifier, reading it from the registry: made by a workflow run in that repository, signed by that workflow.

gh attestation verify \
  oci://ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c \
  --bundle-from-oci \
  --repo=northcutted/clearcutt-showcase-platform \
  --signer-workflow=github.com/northcutted/clearcutt-factory/.github/workflows/images.yml \
  --source-ref=refs/heads/main

Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman. clearcutt-factory takes no source-ref flag; the cosign commands above check the ref.

clearcutt-factory verify \
  --image=ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","vulnerabilityScan","provenance","recipe"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-platform","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-checkout","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-catalog","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-storefront","sourceRef":"refs/heads/main","sourceMatchesImage":true}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":7,"stackSigners":[{"identity":"https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main","issuer":"https://token.actions.githubusercontent.com"}]}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, gh attestation, clearcutt-factory, clearcutt-verify, as of clearcutt-verify v0.16.0, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-17 11:58 UTC, 1 day before this report. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

	critical	high	medium	low	negligible	unknown
Findings	0	0	0	0	0	0
With a fix	0	0	0	0	0	0

No findings.

Tests and rebuilds

Tests

The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && node -e "console.log(process.version, process.versions.openssl)") that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Rebuild

Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-17 12:01 UTC

Rebuild gave sha256:e3620169865afc9915c4bc4bf1b4428140f0864f5c1e1e017ed67a920cf7e01c, the same digest as the image.

Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.

Checked by a clearcutt-factory reproduction attestation, verified against a trusted signer; this run didn't rebuild it.

Attestation signed by https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0 (issuer https://token.actions.githubusercontent.com)

ghcr.io/northcutted/clearcutt-showcase/platform/run-node@sha256:6fb9eed6496bd3fff091237c8e6e13c371ff322b9c3b9ff43a7ba62579662295

Where it was reproduced, as the attestation says:

Run: https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1
Workflow northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main, job reproduce
Machine: github-hosted, linux/amd64
clearcutt-factory v0.2.0
BuildKit moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base	Critical	High
2026-10-19 07:41 UTC	`sha256:e3620169865a`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 01:05 UTC	`sha256:e3620169865a`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 01:02 UTC	`sha256:e3620169865a`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 00:27 UTC	`sha256:e3620169865a`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 00:20 UTC	`sha256:e3620169865a`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:29 UTC	`sha256:e3620169865a`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:11 UTC	`sha256:e3620169865a`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:10 UTC	`sha256:e3620169865a`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 07:25 UTC	`sha256:e3620169865a` base moved	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:43 UTC	`sha256:e3620169865a`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:38 UTC	`sha256:e3620169865a`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:06 UTC	`sha256:e3620169865a`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:03 UTC	`sha256:e3620169865a`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 12:20 UTC	`sha256:e3620169865a` rebuilt, same base	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 07:25 UTC	`sha256:f12bc0c8f6b0`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	4	22
2026-10-17 03:58 UTC	`sha256:f12bc0c8f6b0` rebuilt, same base	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	4	22
2026-10-17 01:19 UTC	`sha256:756d5eb4c0ae`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0

? means unknown: the run had no vulnerability data for this image.

Critical findings

High findings

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:a7ca0c7cf9e485ab389370c8eebc2665b8c49367ba6e4751c388df7c9c01797a`	13	58 MB
linux/arm64	`sha256:a836bb2566b2fe96ae1e0443e8c3cf8ee67969ac352909c6e6b4d792d9809b0d`	13	56 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

29 package versions

Package	Version	Type
apk-tools	2.14.10-r17	apk
busybox	1.38.0-r3	apk
c-ares	1.34.8-r4	apk
ca-certificates-bundle	20260909-r2	apk
glibc-2.44	2.44-r8	apk
glibc-2.44-locale-posix	2.44-r8	apk
icu78-data-full	78.3-r4	apk
ld-linux-2.44	2.44-r8	apk
libbrotlicommon1	1.2.0-r6	apk
libbrotlidec1	1.2.0-r6	apk
libbrotlienc1	1.2.0-r6	apk
libcrypt1-2.44	2.44-r8	apk
libcrypto3	3.6.5-r2	apk
libgcc	16.2.0-r1	apk
libicu78	78.3-r4	apk
libnghttp2-14	1.70.0-r5	apk
libssl3	3.6.5-r2	apk
libstdc++	16.2.0-r1	apk
libuv	1.53.0-r0	apk
libxcrypt	4.5.2-r6	apk
nodejs-24	24.22.0-r0	apk
openssl-4.0-libcrypto	4.0.3-r7	apk
openssl-4.0-libssl	4.0.3-r7	apk
openssl-provider-legacy-allowed	4.0.3-r1	apk
tzdata	2026e-r0	apk
wolfi-base	1-r7	apk
wolfi-baselayout	20230201-r30	apk
wolfi-keys	1-r13	apk
zlib	1.3.2.1_rc20260921-r0	apk