grafana 13.2.3-tpio.4 trivy

grafana image page

publish scan at 2026-10-17T02:41:20Z. Digest: sha256:ad0eda2dd89ae183ace8ddc38e8854e4e644e6ae9ac3a996f4873a1767d86ceb.

Predicates verified from the signed registry attestations.

Predicate type: https://thepeoples.io/attestations/trivy-report/v1. SHA-256 of original predicate (compact JSON plus newline): 620a7eb7272a51fe23e7d2c5c45b447c91bc7bbe09c6d4458726b0ab5c6cd21b.

cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/trivy-report/v1 oci.thepeoples.io/hardened/grafana@sha256:ad0eda2dd89ae183ace8ddc38e8854e4e644e6ae9ac3a996f4873a1767d86ceb | jq -r '.payload' | base64 -d | jq -c '.predicate' | sha256sum

Private fields prevent static publication of the original JSON. The view below shows public fields. Fetch the unchanged signed original with the command above.

5 findings, including suppressed matches where reported.