Where did everything in this image come from?

1Bottom line

• •Debian 12 base supplied 87 components (46%) and the application build added 102 components (54%) of the 189 found in this image.
• •Of 283 known vulnerabilities, 235 (83%) are inherited from Debian 12 base and 48 (17%) were introduced by the application build.
• !Most critical/high-severity vulnerabilities (57 of 63) are inherited from Debian 12 base. None of them has a fix available (the vendor has not released one yet for 49, has deferred 7 and will not fix 1), so no rebuild can remove them today. They need a documented risk decision or tracking until the vendor ships fixes.
• !14 vulnerabilities will never be removed by updating: the vendor will not fix 14. Each needs a documented risk decision (for example a VEX statement or POA&M entry) or a different component.
• !83 program files (83 in the application build) were not installed by any package manager. Nobody can patch or verify them automatically; each one must be tracked back to the team that copied it in.
• ✓The application build updated 1 OS package beyond the versions shipped in Debian 12 base.

2Where the contents came from

An image is built in layers, like a cake. The bottom tiers come from the base image, and the tiers on top are added by the application team's build. Each layer is attributed to whoever produced it.

3How the image was built, step by step

Each step created one layer. The colour shows who is responsible for that step.

1. 1
   Debian 12 base 26.9 MB · 87 components · 235 vulnerabilities · 2026-09-18

   Added 87 OS packages

   Build record: Root filesystem created by the image publisher's build tooling

   Technical detail

   Instruction

   RUN

   Command

   # debian.sh --arch 'amd64' out/ 'bookworm' '@1789689600'

   Layer digest

   sha256:34467cc93912af891dfee8a3902adf9b4f355a9bca4eaa46f658d1181a21de0d

   Files

   3,773 added, 0 replaced, 0 deleted

2. 2
   Python image build 3.8 MB · 5 components · 14 vulnerabilities · 2026-10-01

   Added 4 OS packages; updated 1 OS package

   Build record: Installed operating-system packages (apt); Removed files / cleaned caches

   Technical detail

   Instruction

   RUN

   Command

   /bin/sh -c set -eux; 	apt-get update; 	apt-get install -y --no-install-recommends 		ca-certificates 		netbase 		tzdata 	; 	rm -rf /var/lib/apt/lists/*

   Layer digest

   sha256:d476c6746ca1e1594f36c28af7f3ebee76d63c6a6adaabcc2824c388930bf846

   Files

   507 added, 1,270 replaced, 0 deleted

3. 3
   Python image build 13.0 MB · 97 components · 34 vulnerabilities · 2026-10-01

   Added 83 untraceable program files, 13 OS packages and 1 Python library

   Build record: Installed operating-system packages (apt); Compiled software from source code; Downloaded files from the internet; Unpacked an archive

   Medium Content was downloaded directly from the internet, bypassing vendor-signed packages

   Technical detail

   Instruction

   RUN

   Command

   /bin/sh -c set -eux; 		savedAptMark="$(apt-mark showmanual)"; 	apt-get update; 	apt-get install -y --no-install-recommends 		dpkg-dev 		g++ 		gcc 		gnupg 		libbluetooth-dev 		libbz2-dev 		libc6-dev 		libdb-dev 		libffi-dev 		libgdbm-dev 		liblzma-dev 		libncursesw5-dev 		libreadline-dev 		libsqlite3-dev 		libssl-dev 		make 		tk-dev 		uuid-dev 		wget 		xz-utils 		zlib1g-dev 	; 		wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; 	echo "$PYTHON_SHA256 *python.tar.xz" | sha256sum -c -; 	wget -O python.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc"; 	GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; 	gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$GPG_KEY"; 	gpg --batch --verify python.tar.xz.asc python.tar.xz; 	gpgconf --kill all; 	rm -rf "$GNUPGHOME" python.tar.xz.asc; 	mkdir -p /usr/src/python; 	tar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; 	rm python.tar.xz; 		cd /usr/src/python; 	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; 	./configure 		--build="$gnuArch" 		--enable-loadable-sqlite-extensions 		--enable-optimizations 		--enable-option-checking=fatal 		--enable-shared 		$(test "${gnuArch%%-*}" != 'riscv64' && echo '--with-lto') 		--with-ensurepip 	; 	nproc="$(nproc)"; 	EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; 	LDFLAGS="$(dpkg-buildflags --get LDFLAGS)"; 	LDFLAGS="${LDFLAGS:-} -Wl,--strip-all"; 	arch="$(dpkg --print-architecture)"; arch="${arch##*-}"; 	case "$arch" in 		amd64|arm64) 			EXTRA_CFLAGS="${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer"; 			;; 		i386) 			;; 		*) 			EXTRA_CFLAGS="${EXTRA_CFLAGS:-} -fno-omit-frame-pointer"; 			;; 	esac; 	make -j "$nproc" 		"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}" 		"LDFLAGS=${LDFLAGS:-}" 	; 	rm python; 	make -j "$nproc" 		"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}" 		"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\$\$ORIGIN/../lib'" 		python 	; 	make install; 		cd /; 	rm -rf /usr/src/python; 		find /usr/local -depth 		\( 			\( -type d -a \( -name test -o -name tests -o -name idle_test \) \) 			-o \( -type f -a \( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \) \) 		\) -exec rm -rf '{}' + 	; 		ldconfig; 		apt-mark auto '.*' > /dev/null; 	apt-mark manual $savedAptMark; 	find /usr/local -type f -executable -not \( -name '*tkinter*' \) -exec ldd '{}' ';' 		| awk '/=>/ { so = $(NF-1); if (index(so, "/usr/local/") == 1) { next }; gsub("^/(usr/)?", "", so); printf "*%s\n", so }' 		| sort -u 		| xargs -rt dpkg-query --search 		| awk 'sub(":$", "", $1) { print $1 }' 		| sort -u 		| xargs -r apt-mark manual 	; 	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; 	rm -rf /var/lib/apt/lists/*; 		export PYTHONDONTWRITEBYTECODE=1; 	python3 --version; 	pip3 --version

   URLs contacted

   • https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz
   • https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc

   Layer digest

   sha256:bb21db850823bcb6669b652ce8bff42787673cc8136550cc2d783af0415dc486

   Files

   1,610 added, 16 replaced, 0 deleted

4. 4
   Python image build 249 B · 0 components · 0 vulnerabilities · 2026-10-01

   No software components; 5 file(s) written, 0 removed

   Build record: Edited or created configuration files

   Technical detail

   Instruction

   RUN

   Command

   /bin/sh -c set -eux; 	for src in idle3 pip3 pydoc3 python3 python3-config; do 		dst="$(echo "$src" | tr -d 3)"; 		[ -s "/usr/local/bin/$src" ]; 		[ ! -e "/usr/local/bin/$dst" ]; 		ln -svT "$src" "/usr/local/bin/$dst"; 	done

   Layer digest

   sha256:f4572018cf8016fadccf2df095d62525be857901cf1d837892078204a8f6cf43

   Files

   5 added, 0 replaced, 0 deleted

4Findings that need attention

Issues are grouped by who introduced them, so each one can be routed to the right owner.

5Vulnerabilities and who introduced them

Every known vulnerability, traced to the build step that installed the affected component.

6Complete component inventory

Every package, library and program file found, with its supplier and the evidence behind that answer.

7How this report was produced