dhi.io/envoy
Envoy 1.36.x (fips, dev)
1.36-debian-fips-dev, 1.36-debian13-fips-dev, 1.36-fips-dev, 1.36.13-debian-fips-dev, 1.36.13-debian13-fips-dev, 1.36.13-fips-dev
sha256:1c43a9aa62eebca40107055afdc7c404fe1325ac1977d7881226edd8ed66bd3a
Manifest digest:sha256:61665750b87dce6a63a8a03dc68b9c88ec6768865f17d1d49afb5b60fb016b96
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/envoy:1.36-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/envoy:1.36-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/envoy@sha256:09408fbcda5c14bb2fe0b3f0cbb2e2ff2572814d595bb50caadffffe468f918a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/envoy@sha256:86d5c60a296e8ba52a6580508d8e0b95fe6bcc3120456a64765e1d05c58059fa |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/envoy@sha256:cf42c06b5e31c00d2a54bd197f32db9d9d25df320f1308b502dea81b07b403bb |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/envoy@sha256:170cfe0d0ceb80d4ecf7a742303fa243951327a6fa7847cf96f15c9abb4d3e03 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/envoy@sha256:f960da1c543f10933884c8a2ab5d17686204e72de455735d67cec58879e77942 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/envoy@sha256:400cc58c42180356c5668326a19d88831df76c36b06cab9c9a3651ac20ea5272 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/envoy@sha256:632c11c159687dff39f6077ea90a692f2461dbb0f8b1e3b099cb0d3f37d86dbb |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/envoy@sha256:4a95e60cab02a9603f22cd8bd59a325f6e6f0094173a13bee493d1d85fb7d639 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/envoy@sha256:a636204ce071c55cbdf3813a331dab78e53e2ad4ac8e7f4ee01359fc517dae2e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/envoy@sha256:ed8062467c9c871093d69a067383d22a09449770db273bc97d655ba04c386b7d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/envoy@sha256:9a56704f85d38fa8609d7e7606948baeb6d9ba3611e6bbbe8ccad790d491e9a7 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/envoy@sha256:174e711e99b848fd692e1ccc21abffc5cc5a2d3071c53ab80ccb5165b3d27102 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/envoy@sha256:2cf820ab65c6c13504081cf7b518ea82cb3a88b5a8a01a4427801e72b67de075 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/envoy@sha256:f19dec616cd78d7cf7a83ac936a09c6eff545a1de9c6f6fc985becf874080ce4 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/envoy@sha256:e17fa7f069e14dff056a9a836e96abd0f526e9a1d74bdb85c61510b1a345bcdc |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/envoy@sha256:055caec372fdda7a10d3a040b69346d93ee6a0edb0d9b427eabab19c1d6dffc9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/envoy@sha256:5ce23dd91cb58dd904c34645b81aef950e037ec067259c3f911c7d366f41a9ea |