Find glibc version used in base-nossl-debian12:nonroot about distroless

[loosebazooka]

Yeah we don't do a great job of adding build information to the image. Perhaps we should add some labels into the image so you can just trace it back to the source?

tldr: the answer appears to be: 2.36-9+deb12u4

You can inspect the image to find the libc version, if you have a tool to do that, the distroless specific info file has the debian control info:

/var/lib/dpkg/status.d/libc6

Also, there are sboms published with images. For instance your image you can find the libc6 version (in my test, we got some repetition here, I'm not sure if we need to modify our sbom generation a bit, but the data is there:

$ cosign download attestation gcr.io/distroless/base-nossl-debian12:nonroot@sha256:51ab103bb161fdf8fee4c6311a2d41f484effc409d4f4c58342ab68b2da7ccc2 | jq -rcs '.[0].payload' | base64 -d | jq -r '.predicate' | jq -r '.packages.[] | select(.name == "libc6") | .versionInfo'

[jpmca12]

Thanks @loosebazooka. I am able to extract the version using above command.