dockle

Lint container images for security best practices

goodwithtech/dockle · Container Security › Image Scanning · scanned v0.4.15 (released 2025-01-06) · commit 54368575d2a0 · last scan 2026-11-02

101
declared dependencies
9 / 18
critical / high advisories
35
advisories with a fixed version
76
advisories with vulnerable code in the go1.22.10 binary
4.1
OpenSSF Scorecard (of 10); OpenSSF public dataset
checksums only
release verification

Changes since last week

no change.

Known vulnerabilities (42)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

SeverityAdvisoryPackageVersionFixed inOSVReleased binaryKEVEPSSDeclared inDispute
CriticalGHSA-5cgq-3rg8-m6cv source
CVE-2026-42508
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno6.9%go.modDispute
CriticalGHSA-89gr-r52h-f8rx source
CVE-2026-39831
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.5%go.modDispute
CriticalGHSA-f5wc-c3c7-36mc source
CVE-2026-39832
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.7%go.modDispute
CriticalGHSA-jppx-rxg9-jmrx source
CVE-2026-39833
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.5%go.modDispute
CriticalGHSA-rm3j-f69w-wqmq source
CVE-2026-39834
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.6%go.modDispute
CriticalGHSA-v778-237x-gjrc source
CVE-2024-45337
golang.org/x/crypto
golang
v0.29.00.31.0✓not in released binaryno3.2%go.modDispute
CriticalGHSA-vgwf-h737-ff37 source
CVE-2026-39830
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.7%go.modDispute
CriticalGHSA-x527-x647-q7gg source
CVE-2026-46595
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.6%go.modDispute
CriticalGHSA-p77j-4mvh-x3m3 source
CVE-2026-33186
google.golang.org/grpc
golang
v1.68.01.79.3✓not in released binaryno1.6%go.modDispute
HighGHSA-rg2x-37c3-w2rh source
CVE-2026-42306
github.com/docker/docker
golang
v27.3.1+incompatibleno fix listed✓vulnerable code in binaryno0.1%go.modDispute
HighGHSA-x86f-5xw2-fm2r source
CVE-2026-41567
github.com/docker/docker
golang
v27.3.1+incompatibleno fix listed✓vulnerable code in binaryno0.2%go.modDispute
HighGO-2026-4887 source
CVE-2026-34040, GHSA-x744-4wpc-v9h2
github.com/docker/docker
golang
v27.3.1+incompatibleno fix listed✓vulnerable code in binaryno9.3%go.modDispute
HighGHSA-259r-337f-4rfw source
CVE-2026-63209
github.com/klauspost/compress
golang
v1.17.111.18.7✓vulnerable code in binaryno0.6%go.modDispute
HighGHSA-cgrx-mc8f-2prm source
CVE-2025-52881
github.com/opencontainers/selinux
golang
v1.11.11.13.0✓module in binaryno0.8%go.modDispute
HighGHSA-hcg3-q754-cr77 source
CVE-2025-22869
golang.org/x/crypto
golang
v0.29.00.35.0✓not in released binaryno0.9%go.modDispute
HighGHSA-q4h4-gmj2-qvw2 source
CVE-2026-46597
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.5%go.modDispute
HighGHSA-w879-237q-wc7r source
CVE-2026-39829
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.5%go.modDispute
HighGO-2025-4116 source
CVE-2025-47913
golang.org/x/crypto
golang
v0.29.00.43.0✓not in released binaryno0.7%go.modDispute
HighGO-2026-6303 source
CVE-2026-56854
golang.org/x/crypto
golang
v0.29.00.55.0✓not in released binaryno0.4%go.modDispute
HighGO-2026-6354 source
CVE-2026-78662
golang.org/x/crypto
golang
v0.29.00.56.0✓not in released binaryno0.4%go.modDispute
HighGO-2026-6355 source
CVE-2026-56855
golang.org/x/crypto
golang
v0.29.00.56.0✓not in released binaryno0.5%go.modDispute
HighGHSA-6v2p-p543-phr9 source
CVE-2025-22868
golang.org/x/oauth2
golang
v0.23.00.27.0✓vulnerable code in binaryno0.9%go.modDispute
HighGO-2026-5970 source
CVE-2026-56852
golang.org/x/text
golang
v0.20.00.39.0✓not in released binaryno0.5%go.modDispute
HighGO-2026-6629 source
CVE-2026-56851
golang.org/x/text
golang
v0.20.00.41.0✓not in released binaryno0.5%go.modDispute
HighGHSA-2v4p-qf9q-27wj source
CVE-2026-84445
google.golang.org/grpc
golang
v1.68.01.82.2✓not in released binaryno0.6%go.modDispute
HighGHSA-hrxh-6v49-42gf sourcegoogle.golang.org/grpc
golang
v1.68.01.82.1✓not in released binaryno—go.modDispute
HighGHSA-vp52-pcj8-j9qc source
CVE-2026-84304
google.golang.org/grpc
golang
v1.68.01.83.1✓not in released binaryno0.6%go.modDispute
MediumGHSA-685w-q87j-wqw3 source
CVE-2026-85747
github.com/docker/distribution
golang
v2.8.3+incompatibleno fix listed✓vulnerable code not in binaryno0.2%go.modDispute
MediumGHSA-pxq6-2prw-chj9 source
CVE-2026-33997
github.com/docker/docker
golang
v27.3.1+incompatibleno fix listed✓vulnerable code in binaryno0.4%go.modDispute
MediumGHSA-vp62-88p7-qqf5 source
CVE-2026-41568
github.com/docker/docker
golang
v27.3.1+incompatibleno fix listed✓vulnerable code in binaryno0.1%go.modDispute
MediumGHSA-mjcv-p78q-w5fw source
CVE-2026-61801
github.com/moby/sys/user
golang
v0.3.00.4.1✓vulnerable code in binaryno0.1%go.modDispute
MediumGHSA-jc7w-c686-c4v9 source
CVE-2025-58058
github.com/ulikunitz/xz
golang
v0.5.120.5.15✓module in binaryno0.4%go.modDispute
MediumGHSA-45gg-vh54-h5m9 source
CVE-2026-39828
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.4%go.modDispute
MediumGHSA-78mq-xcr3-xm33 source
CVE-2026-39835
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.5%go.modDispute
MediumGHSA-9m57-25v3-79x9 source
CVE-2026-46598
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.4%go.modDispute
MediumGHSA-f6x5-jh6r-wrfv source
CVE-2025-47914
golang.org/x/crypto
golang
v0.29.00.45.0✓not in released binaryno0.5%go.modDispute
MediumGHSA-j5w8-q4qc-rx2x source
CVE-2025-58181
golang.org/x/crypto
golang
v0.29.00.45.0✓not in released binaryno0.6%go.modDispute
MediumGHSA-qpw4-5x99-6vjp source
CVE-2026-39827
golang.org/x/crypto
golang
v0.29.00.52.0✓not in released binaryno0.3%go.modDispute
MediumGHSA-qc2q-p7wx-3px3 source
CVE-2026-84303
google.golang.org/grpc
golang
v1.68.01.83.1✓not in released binaryno0.3%go.modDispute
LowGHSA-4vq8-7jfc-9cvp source
CVE-2025-54410
github.com/docker/docker
golang
v27.3.1+incompatible28.0.0✓vulnerable code not in binaryno0.2%go.modDispute
LowGO-2026-5024 source
CVE-2026-39824
golang.org/x/sys
golang
v0.28.00.44.0✓vulnerable code not in binaryno0.1%go.modDispute
UnknownGO-2026-5932 sourcegolang.org/x/crypto
golang
v0.29.0no fix listed✓not in released binaryno—go.modDispute

Second opinion: OSV-Scanner

OSV-Scanner found 44 advisories in the same files; 42 of Grype's matches are confirmed by it (marked ✓ above). 2 advisories were reported only by OSV-Scanner.

Reported only by OSV-Scanner (2)
AdvisoryPackageVersionSeverity
CVE-2020-8912, GHSA-7f33-f4f5-xwgw, GO-2022-0635github.com/aws/aws-sdk-go1.55.5Unknown
CVE-2020-8911, GHSA-f5pg-7wfw-84q9, GO-2022-0646github.com/aws/aws-sdk-go1.55.5Unknown

Vulnerable code in the released binary

govulncheck analyzed dockle from dockle_0.4.15_Linux-64bit.tar.gz, built with go1.22.10. 76 advisories have vulnerable functions compiled into it: 66 in the Go standard library and 10 in dependencies.

Of the 42 Go advisories Grype matched in the source, 32 are in modules or code paths that are not in the shipped binary.

The Go linker removes unreachable functions, so a vulnerable function in the binary is likely reachable. Standard-library advisories are fixed by rebuilding with a newer Go release.

AdvisoryModuleVersionFixed inSummary
GO-2025-3373
CVE-2024-45341
stdlibv1.22.10v1.22.11Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
GO-2025-3420
CVE-2024-45336
stdlibv1.22.10v1.22.11Sensitive headers incorrectly sent after cross-domain redirect in net/http
GO-2025-3503
CVE-2025-22870, GHSA-qxp5-gwg8-xv66
stdlibv1.22.10v1.23.7HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
GO-2025-3563
CVE-2025-22871
stdlibv1.22.10v1.23.8Request smuggling due to acceptance of invalid chunked data in net/http
GO-2025-3751
CVE-2025-4673
stdlibv1.22.10v1.23.10Sensitive headers not cleared on cross-origin redirect in net/http
GO-2025-3849
CVE-2025-47907
stdlibv1.22.10v1.23.12Incorrect results returned from Rows.Scan in database/sql
GO-2025-3956
CVE-2025-47906, CVE-2025-47906
stdlibv1.22.10v1.23.12Unexpected paths returned from LookPath in os/exec
GO-2025-4006
CVE-2025-61725, CVE-2025-61725
stdlibv1.22.10v1.24.8Excessive CPU consumption in ParseAddress in net/mail
GO-2025-4007
CVE-2025-58187, CVE-2025-58187
stdlibv1.22.10v1.24.9Quadratic complexity when checking name constraints in crypto/x509
GO-2025-4008
CVE-2025-58189, CVE-2025-58189
stdlibv1.22.10v1.24.8ALPN negotiation error contains attacker controlled information in crypto/tls
GO-2025-4009
CVE-2025-61723, CVE-2025-61723
stdlibv1.22.10v1.24.8Quadratic complexity when parsing some invalid inputs in encoding/pem
GO-2025-4010
CVE-2025-47912, CVE-2025-47912
stdlibv1.22.10v1.24.8Insufficient validation of bracketed IPv6 hostnames in net/url
GO-2025-4011
CVE-2025-58185, CVE-2025-58185
stdlibv1.22.10v1.24.8Parsing DER payload can cause memory exhaustion in encoding/asn1
GO-2025-4012
CVE-2025-58186, CVE-2025-58186
stdlibv1.22.10v1.24.8Lack of limit when parsing cookies can cause memory exhaustion in net/http
GO-2025-4013
CVE-2025-58188, CVE-2025-58188
stdlibv1.22.10v1.24.8Panic when validating certificates with DSA public keys in crypto/x509
GO-2025-4014
CVE-2025-58183, CVE-2025-58183
stdlibv1.22.10v1.24.8Unbounded allocation when parsing GNU sparse map in archive/tar
GO-2025-4015
CVE-2025-61724, CVE-2025-61724
stdlibv1.22.10v1.24.8Excessive CPU consumption in Reader.ReadResponse in net/textproto
GO-2025-4155
CVE-2025-61729, CVE-2025-61729
stdlibv1.22.10v1.24.11Excessive resource consumption when printing error string for host certificate validation in crypto/x509
GO-2025-4175
CVE-2025-61727
stdlibv1.22.10v1.24.11Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
GO-2026-4337
CVE-2025-68121
stdlibv1.22.10v1.24.13Unexpected session resumption in crypto/tls
GO-2026-4340
CVE-2025-61730, CVE-2025-61730
stdlibv1.22.10v1.24.12Handshake messages may be processed at the incorrect encryption level in crypto/tls
GO-2026-4341
CVE-2025-61726, CVE-2025-61726
stdlibv1.22.10v1.24.12Memory exhaustion in query parameter parsing in net/url
GO-2026-4342
CVE-2025-61728, CVE-2025-61728
stdlibv1.22.10v1.24.12Excessive CPU consumption when building archive index in archive/zip
GO-2026-4403
CVE-2025-22873
stdlibv1.22.10v1.23.9Improper access to parent directory of root in os
GO-2026-4601
CVE-2026-25679
stdlibv1.22.10v1.25.8Incorrect parsing of IPv6 host literals in net/url
GO-2026-4602
CVE-2026-27139
stdlibv1.22.10v1.25.8FileInfo can escape from a Root in os
GO-2026-4603
CVE-2026-27142
stdlibv1.22.10v1.25.8URLs in meta content attribute actions are not escaped in html/template
GO-2026-4864
CVE-2026-32282
stdlibv1.22.10v1.25.9TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
GO-2026-4865
CVE-2026-32289
stdlibv1.22.10v1.25.9JsBraceDepth Context Tracking Bugs (XSS) in html/template
GO-2026-4869
CVE-2026-32288
stdlibv1.22.10v1.25.9Unbounded allocation for old GNU sparse in archive/tar
GO-2026-4870
CVE-2026-32283
stdlibv1.22.10v1.25.9Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
GO-2026-4918
CVE-2026-33814
stdlibv1.22.10v1.25.10Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
GO-2026-4946
CVE-2026-32281
stdlibv1.22.10v1.25.9Inefficient policy validation in crypto/x509
GO-2026-4947
CVE-2026-32280
stdlibv1.22.10v1.25.9Unexpected work during chain building in crypto/x509
GO-2026-4970
CVE-2026-39822
stdlibv1.22.10v1.25.12Root escape via symlink plus trailing slash in os
GO-2026-4971
CVE-2026-39836
stdlibv1.22.10v1.25.10Panic in Dial and LookupPort when handling NUL byte on Windows in net
GO-2026-4976
CVE-2026-39825
stdlibv1.22.10v1.25.10ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
GO-2026-4977
CVE-2026-42499
stdlibv1.22.10v1.25.10Quadratic string concatenation in consumePhrase in net/mail
GO-2026-4980
CVE-2026-39826
stdlibv1.22.10v1.25.10Escaper bypass leads to XSS in html/template
GO-2026-4981
CVE-2026-33811
stdlibv1.22.10v1.25.10Crash when handling long CNAME response in net
GO-2026-4982
CVE-2026-39823
stdlibv1.22.10v1.25.10Bypass of meta content URL escaping causes XSS in html/template
GO-2026-4986
CVE-2026-39820
stdlibv1.22.10v1.25.10Quadratic string concatentation in consumeComment in net/mail
GO-2026-5026
CVE-2026-39821
stdlibv1.22.10v1.25.13Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
GO-2026-5037
CVE-2026-27145
stdlibv1.22.10v1.25.11Inefficient candidate hostname parsing in crypto/x509
GO-2026-5038
CVE-2026-42504
stdlibv1.22.10v1.25.11Quadratic complexity in WordDecoder.DecodeHeader in mime
GO-2026-5039
CVE-2026-42507
stdlibv1.22.10v1.25.11Arbitrary inputs are included in errors without any escaping in net/textproto
GO-2026-5856
CVE-2026-42505
stdlibv1.22.10v1.25.12Invoking Encrypted Client Hello privacy leak in crypto/tls
GO-2026-5972
CVE-2026-33818
stdlibv1.22.10v1.25.13Enforce maximum recursion depth in encoding/asn1
GO-2026-6088
CVE-2026-56859
stdlibv1.22.10v1.25.13Add recursion depth guard during decode in encoding/xml
GO-2026-6089
CVE-2026-56853
stdlibv1.22.10v1.25.13Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
GO-2026-6090
CVE-2026-56862
stdlibv1.22.10v1.25.13Limit handshake messages we are willing to accept post-handshake in crypto/tls
GO-2026-6091
CVE-2026-56858
stdlibv1.22.10v1.25.13Fix Javascript regexp context tracking in html/template
GO-2026-6218
CVE-2026-56860
stdlibv1.22.10v1.25.13Avoid quadratic complexity in resolvePath in net/url
GO-2026-6599
CVE-2026-94448
stdlibv1.22.10v1.26.9Reset context tracking on consecutive template expressions in html/template
GO-2026-6600
CVE-2026-97030
stdlibv1.22.10v1.26.9Recognize yield as regexp preceder keyword in html/template
GO-2026-6603
CVE-2026-78659
stdlibv1.22.10v1.26.9HTTP/2 server memory exhaustion due to Trailer headers in net/http
GO-2026-6605
CVE-2026-56866
stdlibv1.22.10v1.26.9HTTP/1 client connection desynchronization after CONNECT rejection in net/http
GO-2026-6607
CVE-2026-97031
stdlibv1.22.10v1.26.9Reject malformed ECH outer extension references in crypto/tls
GO-2026-6608
CVE-2026-94440
stdlibv1.22.10v1.26.9Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
GO-2026-6609
CVE-2026-78667
stdlibv1.22.10v1.26.9Lack of limit on size of parsed Range headers in net/http
GO-2026-6610
CVE-2026-78660
stdlibv1.22.10v1.26.9HTTP/2 transport accepts malformed framing-related headers in net/http
GO-2026-6611
CVE-2026-78669
stdlibv1.22.10v1.26.9Excessive CPU consumption from repeated initial window changes in net/http
GO-2026-6612
CVE-2026-78663
stdlibv1.22.10v1.26.9Double flow control refund on HTTP/2 server streams in net/http
GO-2026-6613
CVE-2026-94439
stdlibv1.22.10v1.26.9HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
GO-2026-6617
CVE-2026-97032
stdlibv1.22.10v1.26.9HTTP/2 server crash due to HPACK encoder race in net/http
GO-2026-6809
CVE-2026-111943
stdlibv1.22.10v1.26.10Distrust compromised intermediate certificates in crypto/x509
GO-2022-0635
CVE-2020-8912, GHSA-7f33-f4f5-xwgw
github.com/aws/aws-sdk-gov1.55.5—In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
GO-2022-0646
CVE-2020-8911, GHSA-f5pg-7wfw-84q9
github.com/aws/aws-sdk-gov1.55.5—CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
GO-2026-4883
CVE-2026-33997, GHSA-pxq6-2prw-chj9
github.com/docker/dockerv27.3.1+incompatible—Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
GO-2026-4887
CVE-2026-34040, GHSA-x744-4wpc-v9h2
github.com/docker/dockerv27.3.1+incompatible—Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker
GO-2026-5617
CVE-2026-42306, GHSA-rg2x-37c3-w2rh
github.com/docker/dockerv27.3.1+incompatible—Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection
GO-2026-5668
CVE-2026-41568, GHSA-vp62-88p7-qqf5
github.com/docker/dockerv27.3.1+incompatible—Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files
GO-2026-5746
CVE-2026-41567, GHSA-x86f-5xw2-fm2r
github.com/docker/dockerv27.3.1+incompatible—Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker
GO-2026-5841
GHSA-259r-337f-4rfw
github.com/klauspost/compressv1.17.11v1.18.7OOB read in github.com/klauspost/compress/s2
GO-2026-6686
CVE-2026-61801, GHSA-mjcv-p78q-w5fw
github.com/moby/sys/userv0.3.0v0.4.1Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user
GO-2025-3488
CVE-2025-22868
golang.org/x/oauth2v0.23.0v0.27.0Unexpected memory consumption during token parsing in golang.org/x/oauth2

Release integrity

Verdict: checksums only for dockle_0.4.15_Linux-64bit.tar.gz.

Verified means a signature, provenance, or attestation was checked against an identity in goodwithtech/dockle's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

Score 4.1/10, assessed 2026-10-19 (OpenSSF public dataset). Scorecard viewer

All checks
CheckScoreReason
CII-Best-Practices0no effort to earn an OpenSSF best practices badge detected
Fuzzing0project is not fuzzed
Maintained00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Security-Policy0security policy file not detected
Signed-Releases0Project has not signed or included provenance with any releases.
Token-Permissions0detected GitHub workflow tokens with excessive permissions
Code-Review2Found 8/29 approved changesets -- score normalized to 2
SAST3SAST tool is not run on all commits -- score normalized to 3
Pinned-Dependencies5dependency not pinned by hash detected -- score normalized to 5
Branch-Protection6branch protection is not maximal on development and all release branches
Binary-Artifacts10no binaries found in the repo
Dangerous-Workflow10no dangerous workflow patterns detected
License10license file detected
Packaging10packaging workflow detected

GitHub Actions workflow audit (zizmor)

11 potential issues in 2 workflow files at this release: 8 high, 3 medium, 0 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

All findings
SeverityRuleLocationNote
Highunpinned-uses
unpinned action reference
.github/workflows/build-scan-on-push.yml:8this step
Highunpinned-uses
unpinned action reference
.github/workflows/build-scan-on-push.yml:10this step
Highunpinned-uses
unpinned action reference
.github/workflows/releasebuild.yml:15this step
Highunpinned-uses
unpinned action reference
.github/workflows/releasebuild.yml:18this step
Highunpinned-uses
unpinned action reference
.github/workflows/releasebuild.yml:21this step
Highunpinned-uses
unpinned action reference
.github/workflows/releasebuild.yml:31this step
Highunpinned-uses
unpinned action reference
.github/workflows/releasebuild.yml:36this step
Highunpinned-uses
unpinned action reference
.github/workflows/releasebuild.yml:43this step
Mediumexcessive-permissions
overly broad permissions
.github/workflows/build-scan-on-push.yml:5this job
Mediumarchived-uses
action or reusable workflow from archived repository
.github/workflows/build-scan-on-push.yml:10this step
Mediumexcessive-permissions
overly broad permissions
.github/workflows/releasebuild.yml:10this job

Dependencies (101)

By ecosystem: golang 95, github 6.

Licenses (as declared in the SBOM): unknown 101.

golang (95)
NameVersionLicenseDeclared in
cloud.google.com/go/authv0.10.0go.mod
cloud.google.com/go/compute/metadatav0.5.2go.mod
dario.cat/mergov1.0.1go.mod
github.com/aws/aws-sdk-gov1.55.5go.mod
github.com/BurntSushi/tomlv1.4.0go.mod
github.com/containerd/cgroups/v3v3.0.3go.mod
github.com/containerd/errdefsv0.3.0go.mod
github.com/containerd/errdefs/pkgv0.3.0go.mod
github.com/containerd/stargz-snapshotter/estargzv0.15.1go.mod
github.com/containerd/typeurl/v2v2.2.0go.mod
github.com/containers/image/v5v5.33.0go.mod
github.com/containers/libtrustv0.0.0-20230121012942-c1716e8a8d01go.mod
github.com/containers/ocicryptv1.2.0go.mod
github.com/containers/storagev1.56.0go.mod
github.com/cpuguy83/go-md2man/v2v2.0.5go.mod
github.com/cyphar/filepath-securejoinv0.3.4go.mod
github.com/d4l3k/messagediffv1.2.2-0.20180726183240-b9e99b2f9263go.mod
github.com/davecgh/go-spewv1.1.2-0.20180830191138-d8f796af33ccgo.mod
github.com/distribution/referencev0.6.0go.mod
github.com/docker/distributionv2.8.3+incompatiblego.mod
github.com/docker/dockerv27.3.1+incompatiblego.mod
github.com/docker/docker-credential-helpersv0.8.2go.mod
github.com/docker/go-connectionsv0.5.0go.mod
github.com/docker/go-unitsv0.5.0go.mod
github.com/felixge/httpsnoopv1.0.4go.mod
github.com/go-logr/logrv1.4.2go.mod
github.com/go-logr/stdrv1.2.2go.mod
github.com/gogo/protobufv1.3.2go.mod
github.com/golang/groupcachev0.0.0-20210331224755-41bb18bfe9dago.mod
github.com/goodwithtech/deckoderv0.0.6go.mod
github.com/google/go-cmpv0.6.0go.mod
github.com/google/go-containerregistryv0.20.2go.mod
github.com/google/go-intervalsv0.0.2go.mod
github.com/google/shlexv0.0.0-20191202100458-e7afc7fbc510go.mod
github.com/google/uuidv1.6.0go.mod
github.com/googleapis/enterprise-certificate-proxyv0.3.4go.mod
github.com/GoogleCloudPlatform/docker-credential-gcr/v2v2.1.26go.mod
github.com/gorilla/muxv1.8.1go.mod
github.com/grpc-ecosystem/grpc-gateway/v2v2.16.0go.mod
github.com/hashicorp/errwrapv1.1.0go.mod
github.com/hashicorp/go-multierrorv1.1.1go.mod
github.com/jmespath/go-jmespathv0.4.0go.mod
github.com/json-iterator/gov1.1.12go.mod
github.com/klauspost/compressv1.17.11go.mod
github.com/klauspost/pgzipv1.2.6go.mod
github.com/knqyf263/nestedv0.0.1go.mod
github.com/mattn/go-sqlite3v1.14.24go.mod
github.com/Microsoft/go-winiov0.6.2go.mod
github.com/Microsoft/hcsshimv0.12.9go.mod
github.com/mistifyio/go-zfs/v3v3.0.1go.mod
github.com/moby/docker-image-specv1.3.1go.mod
github.com/moby/sys/capabilityv0.3.0go.mod
github.com/moby/sys/mountinfov0.7.2go.mod
github.com/moby/sys/userv0.3.0go.mod
github.com/modern-go/concurrentv0.0.0-20180306012644-bacd9c7ef1ddgo.mod
github.com/modern-go/reflect2v1.0.2go.mod
github.com/opencontainers/go-digestv1.0.0go.mod
github.com/opencontainers/image-specv1.1.0go.mod
github.com/opencontainers/runtime-specv1.2.0go.mod
github.com/opencontainers/selinuxv1.11.1go.mod
github.com/ostreedev/ostree-gov0.0.0-20210805093236-719684c64e4fgo.mod
github.com/owenrumney/go-sarif/v2v2.0.17go.mod
github.com/pkg/errorsv0.9.1go.mod
github.com/pmezard/go-difflibv1.0.1-0.20181226105442-5d4384ee4fb2go.mod
github.com/russross/blackfriday/v2v2.1.0go.mod
github.com/sirupsen/logrusv1.9.3go.mod
github.com/stretchr/objxv0.5.2go.mod
github.com/stretchr/testifyv1.10.0go.mod
github.com/sylabs/sif/v2v2.19.1go.mod
github.com/tchap/go-patricia/v2v2.3.1go.mod
github.com/toqueteos/webbrowserv1.2.0go.mod
github.com/ulikunitz/xzv0.5.12go.mod
github.com/urfave/cliv1.22.15go.mod
github.com/vbatts/tar-splitv0.11.6go.mod
go.opencensus.iov0.24.0go.mod
go.opentelemetry.io/auto/sdkv1.1.0go.mod
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpv0.54.0go.mod
go.opentelemetry.io/otelv1.33.0go.mod
go.opentelemetry.io/otel/metricv1.33.0go.mod
go.opentelemetry.io/otel/tracev1.33.0go.mod
go.uber.org/atomicv1.7.0go.mod
go.uber.org/multierrv1.6.0go.mod
go.uber.org/zapv1.17.0go.mod
golang.org/x/cryptov0.29.0go.mod
golang.org/x/expv0.0.0-20241009180824-f66d83c29e7cgo.mod
golang.org/x/oauth2v0.23.0go.mod
golang.org/x/syncv0.9.0go.mod
golang.org/x/sysv0.28.0go.mod
golang.org/x/textv0.20.0go.mod
golang.org/x/timev0.0.0-20220210224613-90d013bbcef8go.mod
golang.org/x/xerrorsv0.0.0-20231012003039-104605ab7028go.mod
google.golang.org/genproto/googleapis/rpcv0.0.0-20241118233622-e639e219e697go.mod
google.golang.org/grpcv1.68.0go.mod
google.golang.org/protobufv1.35.2go.mod
gopkg.in/yaml.v3v3.0.1go.mod
github (6)
NameVersionLicenseDeclared in
actions/cachev3.2.2.github/workflows/releasebuild.yml
actions/checkoutmaster.github/workflows/build-scan-on-push.yml
actions/setup-gov5.github/workflows/releasebuild.yml
Azure/container-scanv0.github/workflows/build-scan-on-push.yml
docker/login-actionv1.github/workflows/releasebuild.yml
goreleaser/goreleaser-actionv2.github/workflows/releasebuild.yml

History

WeekVersionDependenciesCriticalHighMediumLowUnknownChanges
2026-11-02v0.4.151019181221—
2026-11-01v0.4.151019181221—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

StandardScoreChecks passedFailed checks
NTIA 2021715/7Supplier Name, Dependency Relationship
CISA 2025505/10Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183444/9Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/goodwithtech__dockle/.

4 manifests and lockfiles scanned

.github/workflows/build-scan-on-push.yml, .github/workflows/releasebuild.yml, go.mod, go.sum

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fgoodwithtech%2Fdockle%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/goodwithtech/dockle/index.html)
[![vulnerable code in binary](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Fgoodwithtech%2Fdockle%2Fin-binary.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/goodwithtech/dockle/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

How the weekly supply-chain report is producedEvery Sunday the catalog's tools are resolved to their latest release. Manifests and workflows go to Syft, Grype, OSV-Scanner, sbomlyze, and zizmor; the release binary and its signatures go to govulncheck, Cosign, slsa-verifier, and GitHub attestation verification; the repository goes to OpenSSF Scorecard. Results are compared with the previous week and published here.Catalog78 tools in READMELatest releaseGitHub API, every SundayManifests & workflowssparse checkout, no testsRelease binaryLinux amd64 + signaturesRepositoryGitHub & OpenSSF dataSyftSBOMGrype + OSV-Scannerknown advisoriessbomlyzediff + minimum elementszizmorworkflow auditgovulncheckvulnerable code in binaryCosign · slsa-verifier · ghrelease verificationOpenSSF Scorecardrepository practicesCompare with last weekdata branch historyThis reportoverview + project pages
ToolWhat it does hereVersion this week
SyftGenerates a CycloneDX SBOM from each release's manifests and lockfiles.1.55.0
GrypeMatches the SBOM against known vulnerabilities.0.121.0
OSV-ScannerChecks the same files against the OSV database to confirm or add matches.2.7.0
govulncheckFor Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.1.9.0
zizmorAudits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.1.31.1
OpenSSF ScorecardScores repository security practices such as code review, branch protection, and pinned dependencies.5.6.0
CosignVerifies Sigstore signatures on the release binary or its checksums file.3.1.4
slsa-verifierVerifies SLSA build provenance published with the release.2.7.1
GitHub CLI attestationsVerifies GitHub artifact attestations for the release binary.—
sbomlyzeDiffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.0.6.0