Image

run-python:3.14

ghcr.io/northcutted/clearcutt-showcase/platform/run-python

Run image for Python 3.14 apps (stack python:1)

Meets every requirement in the policy.

Identity

Digest: sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a
Tags: 3.14
Created: 2026-10-16 00:00 UTC
Built by: clearcutt-factory (clearcutt-factory recipe)
Source: https://github.com/northcutted/clearcutt-showcase-platform at 0131f755c5bff2c855db0583fe9501feb1fa4457 Read from build provenance that verified.
clearcutt-factory: Image run-python; built with v0.2.0; pins 39 packages, 0 tools, 4 images; files clamped to 2026-10-16

Base

Built on: cgr.dev/chainguard/wolfi-base:latest
sha256:030e45cb37187dff322bbefe9658bcaec31b824a5d523380771a64864c9f45d4 (its linux/amd64 image)
How it's known: The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency: A newer version of its base was observed in this run. 1 version and 5 days behind
Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:e2d3af72b200 (its linux/amd64 image)
Measured against the newest version observed in this run, not against upstream.

Built on this image: catalog:latest

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign signature	2026-10-17 11:58 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:48f32a036d8e1dafc15c8209cc190bbc891b5ce88ccb273e7eadea667f785e71
SBOM	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:ae43feea1a1c14e2d12630bdc3b52838cb940fa33a245936bd48b5b167599c43
Vulnerability report	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:bec8883a467f268e150f82bba01e2b7e3adcad9b49cb94970b3ed4019dc61a30
SLSA provenance	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	GitHub attestation	2026-10-17 11:58 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:d49f536da871f41354e210ed7552f74cb143e33c0e0f4651847a3d3caa189094
Recipe	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-showcase-platform	cosign attestation	2026-10-17 11:58 UTC	ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:1b8c6cb1e4b3cb0c28fe4d5ac808c99cdd762ecdc48d51082a5dc3491df55176
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.	—	declared in the recipe	—	The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && python3 -c "import ssl, sys; print(sys.version, ssl.OPENSSL_VERSION)" && ls /usr/lib/libxml2.so.*) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.

cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a

SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:0895de08547cb60ca80916041809522dd9328d8b1438f543641e213a925797ba

SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:cac385ea38fdce97a0970d60a228f9fa30d8439a1e0e8559accdc4cace03f3cb

Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:0895de08547cb60ca80916041809522dd9328d8b1438f543641e213a925797ba

Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:cac385ea38fdce97a0970d60a228f9fa30d8439a1e0e8559accdc4cace03f3cb

SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.

cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a

Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform \
  --certificate-github-workflow-ref=refs/heads/main \
  ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a

SLSA provenance (GitHub). Checks GitHub's artifact attestation with GitHub's own verifier, reading it from the registry: made by a workflow run in that repository, signed by that workflow.

gh attestation verify \
  oci://ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a \
  --bundle-from-oci \
  --repo=northcutted/clearcutt-showcase-platform \
  --signer-workflow=github.com/northcutted/clearcutt-factory/.github/workflows/images.yml \
  --source-ref=refs/heads/main

Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman. clearcutt-factory takes no source-ref flag; the cosign commands above check the ref.

clearcutt-factory verify \
  --image=ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-showcase-platform

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","vulnerabilityScan","provenance","recipe"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-platform","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-checkout","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-catalog","sourceRef":"refs/heads/main","sourceMatchesImage":true},{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/\\.github/workflows/(images|fleet)\\.yml@refs/tags/v\\d+\\.\\d+\\.\\d+$","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-showcase-storefront","sourceRef":"refs/heads/main","sourceMatchesImage":true}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":7,"stackSigners":[{"identity":"https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main","issuer":"https://token.actions.githubusercontent.com"}]}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, gh attestation, clearcutt-factory, clearcutt-verify, as of clearcutt-verify v0.16.0, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-17 11:58 UTC, 1 day before this report. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

	critical	high	medium	low	negligible	unknown
Findings	0	0	1	0	0	0
With a fix	0	0	0	0	0	0

1 findings

ID	Package	Version	Severity	Fixed in	Platforms
CVE-2025-15367	python-3.14	3.14.8_git20261014-r0	medium	no fix known	linux/amd64, linux/arm64

Tests and rebuilds

Tests

The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && python3 -c "import ssl, sys; print(sys.version, ssl.OPENSSL_VERSION)" && ls /usr/lib/libxml2.so.*) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Rebuild

Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-17 12:01 UTC

Rebuild gave sha256:daf68a5f8a3b218366e3ce847d9e4caedaaf4eb2566e4da08e0168a695a8f68a, the same digest as the image.

Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it.

Checked by a clearcutt-factory reproduction attestation, verified against a trusted signer; this run didn't rebuild it.

Attestation signed by https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/tags/v0.2.0 (issuer https://token.actions.githubusercontent.com)

ghcr.io/northcutted/clearcutt-showcase/platform/run-python@sha256:74509a88a57cb3ba257137ae788084da05580d3a10fb6e9f56de16b5d62f0b28

Where it was reproduced, as the attestation says:

Run: https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1
Workflow northcutted/clearcutt-showcase-platform/.github/workflows/platform.yml@refs/heads/main, job reproduce
Machine: github-hosted, linux/amd64
clearcutt-factory v0.2.0
BuildKit moby/buildkit:v0.33.1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base	Critical	High
2026-10-19 07:41 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 01:05 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 01:02 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 00:27 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-19 00:20 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:29 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:11 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 14:10 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-18 07:25 UTC	`sha256:daf68a5f8a3b` base moved	Verified	Proven, stale `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:43 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:38 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:06 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 14:03 UTC	`sha256:daf68a5f8a3b`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 12:20 UTC	`sha256:daf68a5f8a3b` rebuilt, same base	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0
2026-10-17 07:25 UTC	`sha256:4844ef0efd83`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	4	22
2026-10-17 03:58 UTC	`sha256:4844ef0efd83` rebuilt, same base	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	4	22
2026-10-17 01:19 UTC	`sha256:db399d4a7592`	Verified	Proven, current `sha256:030e45cb3718` (linux/amd64)	0	0

? means unknown: the run had no vulnerability data for this image.

Critical findings

High findings

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:0895de08547cb60ca80916041809522dd9328d8b1438f543641e213a925797ba`	13	33 MB
linux/arm64	`sha256:cac385ea38fdce97a0970d60a228f9fa30d8439a1e0e8559accdc4cace03f3cb`	13	30 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

39 package versions

Package	Version	Type
apk-tools	2.14.10-r17	apk
busybox	1.38.0-r3	apk
ca-certificates-bundle	20260909-r2	apk
gdbm	1.26-r7	apk
glibc-2.44	2.44-r8	apk
glibc-2.44-locale-posix	2.44-r8	apk
ld-linux-2.44	2.44-r8	apk
libbrotlicommon1	1.2.0-r6	apk
libbrotlidec1	1.2.0-r6	apk
libbrotlienc1	1.2.0-r6	apk
libbz2-1	1.0.8-r25	apk
libcrypt1-2.44	2.44-r8	apk
libcrypto3	3.6.5-r2	apk
libexpat1	2.9.0-r0	apk
libffi	3.8.0-r2	apk
libgcc	16.2.0-r1	apk
libssl3	3.6.5-r2	apk
libstdc++	16.2.0-r1	apk
libuuid	2.42.4-r0	apk
libxcrypt	4.5.2-r6	apk
libxml2-16	2.15.4-r1	apk
libzstd1	1.5.7-r10	apk
mpdecimal	4.0.1-r4	apk
ncurses	6.6.20261010-r0	apk
ncurses-terminfo-base	6.6.20261010-r0	apk
openssl-4.0-libcrypto	4.0.3-r7	apk
openssl-4.0-libssl	4.0.3-r7	apk
openssl-provider-legacy-allowed	4.0.3-r1	apk
py3-pip-wheel	26.2.1-r4	apk
python-3.14	3.14.8_git20261014-r0	apk
python-3.14-base	3.14.8_git20261014-r0	apk
readline	8.3-r3	apk
sqlite-libs	3.54.1-r0	apk
tzdata	2026e-r0	apk
wolfi-base	1-r7	apk
wolfi-baselayout	20230201-r30	apk
wolfi-keys	1-r13	apk
xz	5.8.4-r0	apk
zlib	1.3.2.1_rc20260921-r0	apk