These counts come from countme, a privacy-respecting feature built into Fedora's package manager. Once a week, each device sends a single anonymous check-in — no personal data, no IP addresses stored, just a count of how many devices are actively using each image. Think of it like a headcount: it tells us how many devices checked in this week, not who they are or what they did.
These checks measure OCI image build best practices adopted across the bootc ecosystem. Signing and SBOM rates are computed from CI workflow step detection over the last 30 days. zstd:chunked, chunking mode, and SLSA provenance are sourced from OCI image supply-chain snapshots.
| Image | Cosign Signing | SBOM | zstd:chunked | chunked (chunka) | SLSA |
|---|---|---|---|---|---|
| Bluefin | Yes | Yes | No | ⚠️ | ✅ |
| Aurora | Yes | Yes | Yes | — | ✅ |
| Bazzite | Yes | Yes | No | — | ✅ |
| ublue-os | Yes | Yes | Not tracked | — | — |
| uCore | Yes | No | No | — | ❌ |
| Zirconium | Yes | No | Yes | — | ❌ |
| bootcrew | Yes | No | No | ✅ | ❌ |
| secureblue | Not tracked | Not tracked | No | — | ❌ |
| BlueBuild | Yes | No | Not tracked | — | — |
Scores from OpenSSF Scorecard. Click a card to view the full report.