FerretDB

ferretdb.io ↗ GHCR ↗ FREE 1 PROJ GRADED

Registry namespace ghcr.io/ferretdb · ranked #17 of publishers. Trust = (3·A + B − 0.5·F) ÷ projects_graded = -0.50 over 1 of 1 tracked projects. × shrinkage 0.10 (1/10 projects graded for full credit) × velocity 0.50 (0% of projects rebuilt in last 90d) → rank -0.03.

PROJECTS

PROJECTS GRADED

1 / 1

FRESH ≤90D

0 / 1

AVG SCORE

0.0

VARIANTS

2 / 2

PROJECT GRADE DISTRIBUTION (1 projects graded)

F 1

Images we track

2 total · 2 scanned · sorted by current score

FerretDB · ferretdb

ghcr.io/ferretdb/ferretdb:1

· 23 MB · 3-arch · pushed 1.4y ago

NOW

FIRST SCAN

14d ago

OPEN CVES

11 / 42 / 40

C / H / M

PULLS

—

repo-level

Pull →

▸ rubric breakdown (6 signals)

-275 · Critical CVEs (fixable) -420 · High CVEs (fixable) -120 · Medium CVEs (fixable) +10 · Runs as non-root +3 · OCI standard labels (≥4) +3 · Multi-arch

docker pull ghcr.io/ferretdb/ferretdb:1

FerretDB · ferretdb

ghcr.io/ferretdb/ferretdb:latest

· 18 MB · 2-arch · pushed 12mo ago

NOW

FIRST SCAN

14d ago

OPEN CVES

11 / 39 / 29

C / H / M

PULLS

—

repo-level

Pull →

▸ rubric breakdown (6 signals)

-275 · Critical CVEs (fixable) -390 · High CVEs (fixable) -87 · Medium CVEs (fixable) +10 · Runs as non-root +3 · OCI standard labels (≥4) +2 · Multi-arch

docker pull ghcr.io/ferretdb/ferretdb:latest

How grades on this page work

Each image is scored 0–100 by the cerodeo-v1 Scout rubric. Grade bands: A ≥ 85 B ≥ 70 C ≥ 55 D ≥ 40 F < 40.

An image starts at 100 and loses points for open CVEs: −25 per fixable Critical, −10 fixable High, −3 fixable Medium, −8 unfixable Critical, −3 unfixable High. It earns points back for hygiene: non-root default (+10), rebuilt in last 90 days (+10), cosign signature (+5), SLSA provenance (+5), SHA256 pinned (+5), SBOM attestation (+3), HEALTHCHECK (+3), OCI labels (+3), multi-arch (+2–3), upstream GH release (+3), README example (+2).

A-grade means score ≥ 85. Working backward from the formula: an image earns A when it has zero fixable Critical CVEs (one is a −25 hit, drops you out of A no matter the hygiene) and at most one fixable High CVE (−10 brings you to 90, still A). Fixable Mediums at −3 and unfixable Highs at −3 are cheap; you can carry a handful before dropping to B. Hygiene bonuses buffer against the smaller CVE penalties — non-root default (+10) alone covers two unfixable Criticals. A publisher with many A grades is one that consistently hits that math: not just avoiding CVEs by accident, but shipping with signed provenance, non-root defaults, and timely rebuilds. The AVG SCORE above is the average 0–100 Scout score across the 2 scanned images in this namespace.

Full rubric with every weight at /about/grades. Changes to any weight ship as a new rubric_version so old snapshots stay auditable.

What people say about FerretDB

Mark as review

No comments yet. Be the first.