dhi.io/nats
NATS 2.15.x (dev)
2-debian-dev, 2-debian13-dev, 2-dev, 2.15-debian-dev, 2.15-debian13-dev, 2.15-dev, 2.15.1-debian-dev, 2.15.1-debian13-dev, 2.15.1-dev
sha256:e6df2ef37b0fe2a6ff292db260453ceb1d4aa694f2e08ba4480ac9857e83f4ba
Manifest digest:sha256:5f2eb199df7d1add292462e871a9f8fe7d9ae3bbfa4de59d0aef3f210b77b235
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/nats:2-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/nats:2-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/nats@sha256:a86bae796f4366bcfca9624a22a2020dde960f7a67daf6b374dfb8ea939363e0 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/nats@sha256:d9391c5e07a4002f59e7f1e01f73fbee11a7e28a5139573e1253c210378a6303 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/nats@sha256:adb4e316a93dcf5983a9c83a69b4e0e2241bfc11beda28588a8ff70b3d84022e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/nats@sha256:2aaee98f905d61825ca2fdd569cfe0a5eb8dcae133ee05d3c5140011aa62376c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/nats@sha256:988672e572e3d30bb633f7fe50af35280ef80087bfcf53e254df18ff56ede272 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/nats@sha256:90c22fb2c84c9df0245b1a7e7c53f29cb865bd80e63cb6ad1dcdf2d81cf09779 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/nats@sha256:aa56fb374b29bb68325e798b0a789c1be2ce20f742f7dd816957ac08558c1f7c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/nats@sha256:ed0497cef44030561c1400e5c02285641586a0f578ca92a6f0745007aa54fcb1 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/nats@sha256:a78abaaf7c1a8e8c446eddee54a4447cff97e920b0749af14175c4c14c7cbc3c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/nats@sha256:1f00aec358980813fb8ff65bf49cf7349af58209c9a6400bdbd7fdf4ce232f7d |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/nats@sha256:671d8991a2e3dd286874877f26f236fc19a9bd70942ea9fbb56b439ce354f56a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/nats@sha256:7217f7a61b04ee34f6b943555671c474744519a873c7b53a5ab9b3c3d7f5f6ce |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/nats@sha256:51acbd32a9cc747a380bfa15161f53ef7b8c032c4d15970d2aae7f560d059391 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/nats@sha256:fb7a54dedf5700d5768cac122c2382b38d6b1ea852dbfcbb88933a10c2a73af8 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/nats@sha256:bb383cc997ca169a7d8037475e5aade9f6bec8420d3cac5b3ebb3a072128a9ef |