Registry

OCI image registry with an embedded web UI and pull-through mirror support. Apache-2.0. linux/amd64.

pending — no published tags

Pull and verification commands will appear after the first verified publication.

Usage

Pending — no published tags. Candidate source and validation records can precede publication. Installation commands become available after the first verified publication.

Evidence

Publish and rescan reports for each tag. Gate is 0 CRITICAL / 0 HIGH from Trivy and Grype. MEDIUM/LOW are listed; they do not block publish. Remaining-CVE tables live here.

pending · pending · worst-of Trivy and Grype at publish.

Corresponding source for pending is pending. Recipes that resolve are on Source.

MEDIUM/LOW tracking is pending; consult retained scanner reports.

Back to pull

This image is here as the OCI registry and pull-through mirror.

Why this image is connected

Registry: OCI registry and pull-through mirror

Status: pending — no published tags. Platform: linux/amd64.

Available tags and scan history

No tags have been published yet. Scan history and SBOM downloads will appear after verified publication.

Rebuild and licence

Full Zot and ZUI rebuilt from pinned source using Go 1.27.2 and Node 24.22.0. Compatible x/net and OpenTelemetry trace exporter updates use GO_BUMPS. Scratch runtime, UID/GID 65532, no shell or build tools. Publication requires fresh unsuppressed 0 CRITICAL / 0 HIGH scans, all nine official-chart functional checks and checksum-verified live source for the exact digest.

Licence: Apache-2.0.

Zot and ZUI are Apache-2.0. Source includes both the official Zot release and the ZUI revision pinned by its Makefile, plus our recipe and recorded dependency changes.

Upstream source

Build recipe publication is pending, not yet published.