dhi.io/envoy
Envoy 1.36.x (dev)
1.36-debian-dev, 1.36-debian13-dev, 1.36-dev, 1.36.12-debian-dev, 1.36.12-debian13-dev, 1.36.12-dev
sha256:c70e1bc49cb4b604da5b42593cdf78ace2aae6b64657d707702029926bceb81c
Manifest digest:sha256:467826d5d364e8e58d66978a267afd488f4171d29f224f314d5136d748290d38
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/envoy:1.36-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/envoy:1.36-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/envoy@sha256:c1bbbed6d3b592cade72bb1e1e92e6c96f09b7811c08356fa65172d903cf30cd |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/envoy@sha256:aad96e498f31af0e8b2326b05b5eed3b2ebfbbf04cd50c35ec99b0270c66ca9f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/envoy@sha256:b53415b8499605ca18582bd63514630e7a31038c9901ca7f8226421395abd862 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/envoy@sha256:871f62826deac6782badb4b15c7a7832d0bdf34eb4598e3a15f0e90076f58e29 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/envoy@sha256:77da8c543ff0bf90109cdce74153d1dbbe475e4b7be51beb9dc47ce310af7b8b |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/envoy@sha256:476484ce31b514bacdef30e6caa312efe558347b7346e29b7bfe449ace86350a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/envoy@sha256:6ae750a0906878b19b5d4ecf698c70d4619d29213116d6c22e15a6420d60cd34 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/envoy@sha256:11a603db35f0d886ff494bf4abd5c43ab88742f7a5a5807f938450f902e243d2 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/envoy@sha256:f31a067f4482530d2739a59d82ba90f897ec50400c6222fd7fa6b071471e7219 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/envoy@sha256:a63f478ff469a1e325a1f5e185b798ea77df8b52ff099d268f1650771b729610 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/envoy@sha256:49315d2f9b6133a208eeda3514c2cef6bf60dd360531b5045bd95c098b7961a4 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/envoy@sha256:32f23eab6129c763cd4b2712260ec51df85cf2126325335b9d5eb7b4c18982be |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/envoy@sha256:74fc1220821070d7b6d1cb03ec985eae334481b7b747a52b77f3e487a184efe7 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/envoy@sha256:328f59753335463ed085d8ae95af3ea93f633d699aca91e7ce5c14e900c808af |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/envoy@sha256:64127b92f717b06f6e4b7170330e363dbfb884b17027e33454e9505535c19126 |