Service 7 · Service · oauth2-proxy image

clearcutt-oauth2-proxy7 : oauth2-proxy

First-class oauth2-proxy image with template-owned ports, storage, lifecycle, and smoke checks.

v0.12.1 amd64arm64 Status: preview Support: CURRENT Non-Prod Only Signature: Verified Provenance: Verified SBOM: Verified Vulnerability scan: Observed Tests: Verified Evidence overlays listed

Multi-arch Manifest Digest:

sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca

Lifecycle Advisory: PREVIEW IMAGE

This image is currently in Preview status. It has catalog evidence, but is not recommended for production environments until general availability.

Release

Published Sat, 04 Jul 2026 13:08:58 GMT

Last Rebuilt Tue, 04 Aug 2026 07:10:14 GMT

Scan data observed

Service Image Usage

Run the platform service, inspect its operational contract, and verify the evidence attached to this release.

Service Contract

oauth2-proxy7 is a platform-owned service image. It is built from the fleet service template, cataloged separately from runtime tiers, and carries ports, storage, lifecycle, smoke, vulnerability, and evidence metadata.

Templateoauth2-proxy7

Lifecyclepreview / non-production

Portshttp:4180/tcp

Storagestateless

Entrypoint/bin/oauth2-proxy

Runtime UserUID 10001:10001

Smokeconfigured

Vulnerabilities14 critical / 24 high / 28 medium

Configured Smoke Commands

oauth2-proxy --version

Pull & Run Service

Use digest-pinned pulls when available; mount volumes for stateful data dirs.

Pull by multi-arch digest

docker pull ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7@sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca

Pinned service tag

docker pull ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7:v0.12.1-service

Run service

docker run --rm \
  --user 10001:10001 \
  -p 4180:4180 \
  ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7:v0.12.1-service

Pull by multi-arch digest

podman pull ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7@sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca

Pinned service tag

podman pull ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7:v0.12.1-service

Run service

podman run --rm \
  --user 10001:10001 \
  -p 4180:4180 \
  ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7:v0.12.1-service

docker-compose.yml yaml

services:
  oauth2-proxy7:
    image: ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7:v0.12.1-service
    user: "10001:10001"
    ports:
      - "4180:4180"

pod.yaml yaml

apiVersion: v1
kind: Pod
metadata:
  name: oauth2-proxy7
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
  containers:
    - name: oauth2-proxy7
      image: ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7:v0.12.1-service
      ports:
        - containerPort: 4180

service-ops.sh shell

clearcutt service explain oauth2-proxy7
clearcutt service validate oauth2-proxy7
clearcutt service smoke oauth2-proxy7 --engine docker --image ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7:v0.12.1-service

service-provenance.sh shell

# Service package attr exposed by the ClearCutt flake.
nix build github:northcutted/clearcutt/v0.12.1#oauth2-proxy7

# Catalog service records are emitted when generation includes services.
clearcutt catalog generate --config clearcutt.fleet.yaml --include-services --output dist/catalog

Verify & Audit Compliance

Inspect catalog evidence, run registry-side verification where evidence exists, and review vulnerability gates.

Provenance & signatures

Cryptographically audit OCI identity claims and supply chain gating artifacts.

raw in-toto JSONL ↗

Cryptographic Proof

CATALOG REPORTS SIGNATURE

Source Repo northcutted/clearcutt

Signing Workflow release.yml

Workflow Ref refs/heads/main

OIDC Issuer token.actions.githubusercontent.com

OIDC Certificate Subject

https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main

Supply Chain Provenance

PROVENANCE RECORDED 3

Builder GitHub Actions (release.yml @ main)

Build Type GitHub Actions Workflow

Predicate Schema SLSA Provenance v1.0

Source Material github.com/northcutted/clearcutt

Commit SHA 7211d7e ↗

Signed provenance record: Passed

Compilation & Tests

TESTS PASSED

Nix Compilation

amd64:passed ↗ arm64:passed ↗

SBOM generation

amd64:passed ↗ arm64:passed ↗

Vulnerability gate

amd64:warning ↗ arm64:warning ↗

Closure Purity (distroless boundary)

amd64:skipped ↗ arm64:skipped ↗

Runtime-Patch Completeness (crypto identity allowlist)

amd64:skipped ↗ arm64:skipped ↗

Gating timestamp: 2026-07-04T12:32

Attestations

4 kinds of evidence for this image. The counts are how many times each was independently signed into the public transparency log — not how many distinct artifacts exist.

22 signed records

Subject ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7 Digest sha256:368035026a82... index · amd64+arm64 Signed By release.yml @ main keyless ✓

Two ways to verify — pick the ecosystem you know

cosign · OCI Attestation lives with the image in the registry. Verify with cosign verify-attestation.

gh CLI · GitHub GitHub first-party attestation. Verify with gh attestation verify.

The subject above is the multi-arch index (amd64 + arm64). Each architecture's SBOM is attested separately, in both ecosystems — so one SBOM naturally appears as several signed records below. Records also accumulate as the image is rebuilt, with each release re-signing into the transparency log afresh. Every entry is independent and publicly verifiable: click any #index below to inspect it in Sigstore Rekor, or use the copy-paste commands below to verify them locally.

Build provenance slsa.dev/provenance/v1

How and where the image was built — binds this digest to the exact workflow run, commit, and builder.

4× signed

Verify with

Inspect

run ↗ workflow file ↗ asset ↗

Rekor log

#2139990577 ↗#2133518995 ↗#2071596434 ↗

SBOM spdx.dev/Document

Software Bill of Materials — the full inventory of packages baked into the image.

9× signed

Verify with

Inspect

workflow file ↗

Rekor log

#2139991501 ↗#2139991069 ↗#2133519803 ↗

Test results cosign.sigstore.dev/attestation/v1

Signed evidence that the release-gate test suite passed for this exact digest.

8× signed

Verify with

Inspect

workflow file ↗

Rekor log

#2139990055 ↗#2139989546 ↗#2133518569 ↗

Cosign signature sigstore.dev/cosign/sign/v1

The keyless cosign signature statement covering the image index.

1× signed

Verify with

Inspect

workflow file ↗

Rekor log

#2133516310 ↗

Active Verification Toolkit

Run registry-side verification commands for the recorded release evidence.

Direct Cryptographic Evidence & Verification

Expected Certificate Subject https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main

Expected Certificate OIDC Issuer https://token.actions.githubusercontent.com

Manifest Index Digest sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca

Raw SPDX SBOMs

Download AMD64 SBOM → Download ARM64 SBOM →

One-step Audit Command

Run the native compiled Go CLI command locally to verify the registry digest, Sigstore signature, SBOM and test attestations, and SLSA provenance:

clearcutt verify release-evidence \
  --ref ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7@sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca \
  --repo northcutted/clearcutt \
  --workflow-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main'

1. Inspect Security Metadata

Query deep, high-fidelity security metadata, dynamic entrypoints, non-root user settings, architectures, and release asset URLs.

CATALOG_DIR=./path/to/catalog
clearcutt --catalog "$CATALOG_DIR" inspect oauth2-proxy7 --tag v0.12.1

2. Local Policy Gate Verification

Check catalog-record evidence flags, smoke tests, vulnerability limits, and lifecycle constraints locally or in CI pipelines. Use the release-evidence command or the Cosign/SLSA tabs for registry-side cryptographic verification.

CATALOG_DIR=./path/to/catalog
clearcutt --catalog "$CATALOG_DIR" verify image oauth2-proxy7 \
  --tag v0.12.1 \
  --require-production \
  --require-signature \
  --require-sbom \
  --require-provenance \
  --max-critical 0 \
  --max-high 5

3. Runtime Conformance Audit

Verify runtime specifications offline, asserting timezone configurations, dynamic links, CA certificate paths, and rootless isolation boundaries.

clearcutt conformance run \
  --expect-runtime service

4. Scaffold Nix Overlay Graft

Under strict corporate base OS mandates, generate a workspace scaffolding to graft this runtime overlay onto existing host layers.

clearcutt overlay generate \
  --runtime service7 \
  --tier service \
  --base registry.access.redhat.com/ubi9/ubi-minimal \
  --output my-service7-overlay/

1. Verify Keyless OIDC Signature

Confirm this OCI image was built in your official release workflow and signed via keyless OIDC certificates.

cosign verify ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7@sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca \
  --certificate-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --output json

2. Verify Cryptographic SBOM Attestation

Extract and cryptographically verify the compiled package software bill of materials statement.

cosign verify-attestation ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7@sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca \
  --type spdxjson \
  --certificate-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  | jq '.payload | @base64d | fromjson | .predicate'

slsa-verifier (SLSA Build L3)

Verify SLSA Build L3 provenance from the configured builder and source ref.

slsa-verifier verify-image ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7@sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca \
  --source-uri 'github.com/northcutted/clearcutt' \
  --source-branch 'main'

GitHub Native Attestation

Audit the GitHub-native provenance attestation using the GitHub CLI client.

gh attestation verify oci://ghcr.io/northcutted/clearcutt/clearcutt-oauth2-proxy7@sha256:368035026a824c7596eab27270f640e63a6d84e0c624856a3c04632e652fdfca \
  --repo northcutted/clearcutt \
  --cert-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --source-ref refs/heads/main

Loading vulnerability data...

Evidence & OCI Specifications

Inspect service SBOMs, image layers, OCI labels, and release history after reviewing the service contract above.

Software Bill of Materials

Every package included in the image's /nix/store closure. Generated from the actual OCI archive at build time and attached as an SPDX SBOM, using the same package inventory as the CVE findings above.

SBOM generated Sat, 04 Jul 2026 12:32:54 GMT. Toggle between architectures; the package set typically matches but layer hashes differ.

Loading SBOM data...

Loading layer data...

Image Specifications & Release Ledger

Inspect the static OCI container metadata labels and browse the immutable published release history for this image.

Key	Value
dev.clearcutt.image.kind	service
dev.clearcutt.recipe.license	Apache-2.0
dev.clearcutt.service.id	oauth2-proxy7
dev.clearcutt.service.template	oauth2-proxy
dev.clearcutt.service.version	7
org.opencontainers.image.authors	ClearCutt maintainers
org.opencontainers.image.description	oauth2-proxy authentication gateway service image
org.opencontainers.image.licenses	NOASSERTION
org.opencontainers.image.ref.name	service
org.opencontainers.image.source	https://github.com/northcutted/clearcutt
org.opencontainers.image.title	clearcutt-oauth2-proxy7
org.opencontainers.image.url	https://github.com/northcutted/clearcutt
org.opencontainers.image.vendor	ClearCutt
org.opencontainers.image.version	7

Tag	Published	Archs	Packages
v0.14.0 latest	Sat, 11 Jul 2026 00:47:46 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.13.0	Fri, 10 Jul 2026 00:21:20 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.12.2	Sat, 04 Jul 2026 17:29:57 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.12.1	Sat, 04 Jul 2026 13:08:58 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.11.1	Wed, 10 Jun 2026 02:52:21 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.11.0	Wed, 10 Jun 2026 01:24:14 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.10.4	Tue, 09 Jun 2026 12:54:17 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.10.2	Sun, 07 Jun 2026 21:31:16 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.10.1	Sun, 07 Jun 2026 16:42:20 GMT	amd64arm64	74	.intoto.jsonl ↗
v0.10.0	Sun, 07 Jun 2026 14:37:59 GMT	amd64arm64	74	.intoto.jsonl ↗