Do not file public issues for vulnerabilities.

Use GitHub private vulnerability reporting from this repository's Security tab:

https://github.com/NWarila/ubi9-base-micro/security/advisories/new

If private reporting is unavailable, contact the maintainer through GitHub:

https://github.com/NWarila

Include:

• Affected commit, branch, tag, or image digest.
• Steps to reproduce or a proof of concept.
• Expected impact.
• Whether the finding affects source, workflow permissions, published image verification, SBOM/VEX evidence, STIG evidence, or release provenance.

The supported line is the latest v* release and any published image digest built from it.

The maintainer will coordinate investigation and remediation through the private reporting thread. Public disclosure should wait until a fix or mitigation is available, or until a mutually agreed disclosure date.

Target response windows:

These are targets, not guarantees.

The verification contract is maintained in docs/reference/verify.md. Use that document as the source of truth for published digest verification.

At a high level, verification requires:

• cosign verify for the published digest signature.
• cosign verify-attestation for SPDX, CycloneDX, Python absence-proof OpenVEX, NIST SP 800-190, tailored STIG ARF, and SLSA provenance predicates.
• slsa-verifier verify-image for the SLSA L3 provenance.
• Exact certificate identities and the GitHub Actions OIDC issuer documented in the verification contract.

The base-python publisher also requires its index-only trust-contract predicate; see the canonical publication evidence contract. Use the image-specific commands in docs/how-to/verify-a-published-image.md for the immutable digest recorded there or another digest from a successful production publication.

Do not substitute gh attestation verify for this repository's release contract; the repository uses cosign OCI attestations for the published image evidence.