Skip to content
CommonLayer

base 3.24.4-r2 · digest

sha256:7901b113c8cb64c1f29fcd7d3f8373333d5c66b8d35fbbc5d6fc6a74ce7f26c9
Submission ·PromotedContainer imagePreserved

Use this digest

Pull by digest (recommended)deploy this
docker pull registry.commonlayer.org/base@sha256:7901b113c8cb64c1f29fcd7d3f8373333d5c66b8d35fbbc5d6fc6a74ce7f26c9
Pull by tag 3.24mutable
docker pull registry.commonlayer.org/base:3.24

Verification policy results

Every check of the verification policy, as evaluated before promotion. The platform states what it verified; it does not claim a SLSA level.

Policy passedPlatform policy v1, evaluated

Verification policy checks
CheckResultWhat was found
source.matches_manifestSource registry and repository equal the project manifestCheck:Passsource ghcr.io/commonlayer-org/base matches the manifest
digest.verifiedFetched content hashes to the submitted digestCheck:Passfetched content hashes to sha256:7901b113c8cb64c1f29fcd7d3f8373333d5c66b8d35fbbc5d6fc6a74ce7f26c9
version.declaredVersion belongs to a supported line in the manifest; the revision is newCheck:Pass3.24.4 is in supported line 3.24 and revision 2 is new
platforms.completeEvery platform the manifest requires is presentCheck:Passplatforms present: linux/amd64, linux/arm64
image.nonrootThe image runs as a non-zero UID, unless the manifest documents a deviationCheck:Passevery platform runs as a non-zero UID
image.labelsRequired OCI and org.commonlayer.* labels are present and consistentCheck:Passrequired labels present and consistent
signature.validAt least one cosign signature verifiesCheck:Pass1 signature(s) verified
signature.identitySigner identity and issuer match the project's registered identityCheck:Passsigned by the registered identity https://github.com/commonlayer-org/base/.github/workflows/*@refs/tags/v* from https://token.actions.githubusercontent.com
sbom.presentA signed SBOM attestation exists for every platformCheck:Pass4 signed SBOM(s) cover every platform
sbom.parsableThe SBOM parses and lists componentsCheck:Pass4 SBOM(s) parsed, 36 components
provenance.presentA signed SLSA provenance attestation existsCheck:Pass1 signed SLSA provenance attestation(s)
provenance.subjectThe provenance subject digest equals the artifact digestCheck:Passprovenance subject is sha256:7901b113c8cb64c1f29fcd7d3f8373333d5c66b8d35fbbc5d6fc6a74ce7f26c9
provenance.sourceThe provenance source is a verified repository of the project and the commit matchesCheck:Passbuilt from github.com/commonlayer-org/base at aea71a4e63bfdd525b8bb244f58d4b2406b62abc
scan.freshA successful scan by at least one scanner completed for this digestCheck:Passa successful scan completed for this digest
scan.gateNo fixable finding at or above the gate severity without an exceptionCheck:Passno fixable finding at or above critical without an exception
chart.images_pinnedChart default images are digests of promoted CommonLayer imagesCheck:Not applicablenot a chart
chart.schemaThe chart ships values.schema.jsonCheck:Not applicablenot a chart

Verify it yourself

Reference: registry.commonlayer.org/base@sha256:7901b113c8cb64c1f29fcd7d3f8373333d5c66b8d35fbbc5d6fc6a74ce7f26c9

Verify the signature against the project's registered identity
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github\.com/commonlayer-org/base/\.github/workflows/.*@refs/tags/v.*$' registry.commonlayer.org/base@sha256:7901b113c8cb64c1f29fcd7d3f8373333d5c66b8d35fbbc5d6fc6a74ce7f26c9
Verify the cyclonedx-json SBOM attestation of linux/amd64
cosign verify-attestation --type cyclonedx --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github\.com/commonlayer-org/base/\.github/workflows/.*@refs/tags/v.*$' registry.commonlayer.org/base@sha256:5ca16ce4d80e37a8826ad9177889bba0a9b4bd72a59753a4a0164750932796fb
Verify the spdx-json SBOM attestation of linux/amd64
cosign verify-attestation --type spdxjson --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github\.com/commonlayer-org/base/\.github/workflows/.*@refs/tags/v.*$' registry.commonlayer.org/base@sha256:5ca16ce4d80e37a8826ad9177889bba0a9b4bd72a59753a4a0164750932796fb
Verify the cyclonedx-json SBOM attestation of linux/arm64
cosign verify-attestation --type cyclonedx --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github\.com/commonlayer-org/base/\.github/workflows/.*@refs/tags/v.*$' registry.commonlayer.org/base@sha256:99129a80240c53c92cc23efa38aebad6354913936ef96286fb331f8a431cd36c
Verify the spdx-json SBOM attestation of linux/arm64
cosign verify-attestation --type spdxjson --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github\.com/commonlayer-org/base/\.github/workflows/.*@refs/tags/v.*$' registry.commonlayer.org/base@sha256:99129a80240c53c92cc23efa38aebad6354913936ef96286fb331f8a431cd36c
Verify the SLSA provenance attestation
cosign verify-attestation --type slsaprovenance1 --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github\.com/commonlayer-org/base/\.github/workflows/.*@refs/tags/v.*$' registry.commonlayer.org/base@sha256:7901b113c8cb64c1f29fcd7d3f8373333d5c66b8d35fbbc5d6fc6a74ce7f26c9
Pull by digest (never by tag)
docker pull registry.commonlayer.org/base@sha256:7901b113c8cb64c1f29fcd7d3f8373333d5c66b8d35fbbc5d6fc6a74ce7f26c9
  • A valid signature proves which workflow, repository and ref produced the digest; it says nothing by itself about the security of the content.
  • Tags are mutable pointers; always deploy by digest.

Signatures

Provenance and attestations

  • SLSA provenanceSignature verified
    Predicate type
    https://slsa.dev/provenance/v1
    Source repository
    https://github.com/commonlayer-org/base
    Commit
    aea71a4e63bfdd525b8bb244f58d4b2406b62abc
    Ref
    refs/tags/v3.24.4-r2
    Workflow
    .github/workflows/release.yml@refs/tags/v3.24.4-r2
    Builder
    https://github.com/commonlayer-org/base/.github/workflows/release.yml@refs/tags/v3.24.4-r2
    Signer
    https://github.com/commonlayer-org/base/.github/workflows/*@refs/tags/v*
    Statement
    sha256:0abd3d141be69a391d076b046d80efa9abc5ff401484eef5c1825f4c7d987b7c Download
  • CycloneDX SBOMSignature verified
    Predicate type
    https://cyclonedx.org/bom
    Signer
    https://github.com/commonlayer-org/base/.github/workflows/*@refs/tags/v*
    Statement
    sha256:4fa66c619d7a7f729fa6c1b3a8656807b9f721fa67b7de66126cb399bedc261b Download
  • SPDX SBOMSignature verified
    Predicate type
    https://spdx.dev/Document
    Signer
    https://github.com/commonlayer-org/base/.github/workflows/*@refs/tags/v*
    Statement
    sha256:74f5fcc7a6887ffbb4b62245e1e865db02d515adfa7a267072acaf63688cb9b1 Download
  • CycloneDX SBOMSignature verified
    Predicate type
    https://cyclonedx.org/bom
    Signer
    https://github.com/commonlayer-org/base/.github/workflows/*@refs/tags/v*
    Statement
    sha256:bd0f6df2c643681777e042ebf56ef6e31583cfa137f5d5d026fba3ae7dd7563b Download
  • SPDX SBOMSignature verified
    Predicate type
    https://spdx.dev/Document
    Signer
    https://github.com/commonlayer-org/base/.github/workflows/*@refs/tags/v*
    Statement
    sha256:cedaeca4e59c0f408738930d7cde4485667790992db8422071994afedc6147dd Download

SBOMs

SBOM downloads
FormatPlatformComponentsDownload
cyclonedx-json 1.7linux/amd649cyclonedx-json (178.9 KiB)
spdx-json SPDX-2.3linux/amd649spdx-json (465.1 KiB)
cyclonedx-json 1.7linux/arm649cyclonedx-json (178.9 KiB)
spdx-json SPDX-2.3linux/arm649spdx-json (465.1 KiB)

Vulnerabilities

Occurrences are bound to this digest forever: a fix published under a new digest never changes this one.

Scanners that ran successfully: OSV, Grype, Trivy. OpenVEX for this digest

  • 0critical
  • 0high
  • 2medium
  • 0low
Vulnerability occurrences
VulnerabilitySeverityPackage
CVE-2025-60876Severity:Mediumbusybox 1.37.0-r31
CVE-2025-60876Severity:Mediumbusybox-binsh 1.37.0-r31

Scan history

Scan history
ScannerStatusFinished
OSV api.osv.dev/v1Succeeded
OSV api.osv.dev/v1Succeeded
OSV api.osv.dev/v1Succeeded
OSV api.osv.dev/v1Succeeded
Grype 0.121.3linux/arm64Succeeded
Grype 0.121.3linux/amd64Succeeded
Trivy 0.76.2linux/arm64Succeeded
Trivy 0.76.2linux/amd64Succeeded
11 older scans
Older scans
ScannerStatusFinished
OSV api.osv.dev/v1Succeeded
OSV api.osv.dev/v1Succeeded
Grype 0.121.3linux/arm64Succeeded
Grype 0.121.3linux/amd64Succeeded
Trivy 0.76.2linux/arm64Succeeded
Trivy 0.76.2linux/amd64Succeeded
OSV api.osv.dev/v1Succeeded
Grype 0.121.3linux/arm64Succeeded
Grype 0.121.3linux/amd64Succeeded
Trivy 0.76.2linux/arm64Succeeded
Trivy 0.76.2linux/amd64Succeeded