dhi.io/envoy
Envoy 1.36.x (dev)
1.36-debian-dev, 1.36-debian13-dev, 1.36-dev, 1.36.13-debian-dev, 1.36.13-debian13-dev, 1.36.13-dev
sha256:2e218b1bb78094bfac9dfa8bdece980752b0043fa3c6332d7022ff981241d4d5
Manifest digest:sha256:d87261547599b6ff987789be97ccc7439ee4e3da1cd9c9ba6e488de26c0abf24
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/envoy:1.36-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/envoy:1.36-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/envoy@sha256:772236da5e27d4fe192ba5af1db3da26e4af7f6e1f8878f6aee69325c55727ef |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/envoy@sha256:83f0b29d92d18b64e0b1da2a0b1011fd97228f01128173515f606b041d62e1b4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/envoy@sha256:cf61ae4e93a2a02e9e0bba285f39f1c5eb46c2721c5bd1792c9cd4d8193438ef |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/envoy@sha256:312bcb9cc63ae91d1b2f61e21a0a24c2dc51181cda73d40b2abe2bf08ec5c513 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/envoy@sha256:1f3c2e009a527f1139f2038b35df37ec52e35d97ebda196cf0e5f53e678739f1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/envoy@sha256:d64362529de82c5cd496b97a5e1a8d54efd534462fc968a6dac47202193806ac |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/envoy@sha256:3140dde9f2ddaa91f1e0ac2254261ab27e7b6045abc363fd4c89e52750cf9137 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/envoy@sha256:12d9b60f25d3be45c6d7162651de39b11e74a38d6b92cab4e7a7a830ee400816 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/envoy@sha256:8ec5d3e31be08aee9e88846ca83d77d14bf1e2aa7ba63952b66641bf994cd189 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/envoy@sha256:77a24090d3aaf928300f66c8cb4ff829605de62308c8a8d13a3ed8838d36529f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/envoy@sha256:106f9868d10d7efa5f8aec76ddc68e061b1c6857e6807d78b2a16b624c55de76 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/envoy@sha256:1dfac3a75e206aabcf50694face4eec1f420a81619af18ed08a2f8773b81f0d2 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/envoy@sha256:d36f985648b8175a731cbb784c3bfeac14c41d1837e5e0adbb0d1fb3468882f6 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/envoy@sha256:2dd8e68ee2ca0b85301cda59f50f844fb76e360cca27a929b18062b239bbc96a |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/envoy@sha256:4e8c69c744114179620c57e2fe275a7a56919d31a6a1c10491cebbdb8af0f0e9 |