Clira · clearance packet · public sample
This is a real packet, produced by the live pipeline. Every value below came out of the run — the scan, the test execution inside the sandbox, and the signature. Nothing here is illustrative. You can recompute the evidence hash yourself and verify the signature in your browser.
| Repository | https://github.com/google/uuid |
|---|---|
| Commit | 2d3c2a9cc518326daf99a383f07c4d3c44317e4d |
| Scanned at | 2026-08-12T19:07:38Z UTC |
| Scope | 33 files · 1,596 lines · {"Go": 16} |
| Findings | 0 — none at any severity |
| Fixes | no findings, so no patches were generated or applied |
The verdict is only worth what the test run is worth, so here it is in full.
| Framework | go |
|---|---|
| Command | go test ./... |
| Ran in sandbox | True |
| Exit code | 0 |
| Result | passed 1 · failed 0 |
ok github.com/google/uuid 1.857s
| Sandbox image | clira/sandbox@sha256:62f94465b6e07ebc18f40c13553fa9b46ac1cf9c057cb72950bc7a08ce418be1 |
|---|---|
| Runtime | gVisor (runsc) |
| Network | none |
| Filesystem | read-only rootfs, tmpfs /tmp |
| User | 65534:65534 |
| Toolchain | go version go1.22.2 linux/amd64 Python 3.12.3 v22.23.2 |
The signature is over a verdict that includes a SHA-256 of the full evidence document. So the signature binds not just the decision, but the commit, the scan result, the test command and its real output, the sandbox image digest and the toolchain versions.
| Evidence SHA-256 | a2aa02ee01475a32779d32485c747cbda74bed506f7443c04289a0ff43fc38d7 |
|---|---|
| Signature | ETdbWxvLDNSXJ1kOkwetmoee76Zr8n4s4Gc6N+VPcnASDBtvlXY8/P2x8urVP6WaufdgvQXIM3lNcu6S5oo3Cg== |
| Algorithm | ed25519 |
| Public key | 15fMX/qUTOyy/TT+1hW2ZxLHNZjUBEZilt5YRkNvT2E= |
Verify this verdict in your browser Download the evidence document
curl -s https://clira.dev/clearance/google-uuid/evidence.json | sha256sum # => a2aa02ee01475a32779d32485c747cbda74bed506f7443c04289a0ff43fc38d7
That digest is inside the signed verdict. Change one byte of the evidence and it stops matching; change the verdict and the ed25519 signature stops verifying. The verifier runs entirely in your browser — nothing is sent to us.
It does not say this code is secure. It says: at this commit, our checks found nothing at critical or high severity, and the project's own test suite ran to completion inside our sandbox and passed. Absence of findings is not proof of absence of vulnerabilities.
This particular repository had no findings, so no patches were generated. It therefore demonstrates the scan, the sandboxed test run and the signature — not the repair loop.
Our test execution runs with no network access. Repositories whose suites require installing dependencies cannot currently be executed, and honestly report "could not verify" rather than a pass.