dhi.io/nats
NATS 2.15.x (dev)
2-debian-dev, 2-debian13-dev, 2-dev, 2.15-debian-dev, 2.15-debian13-dev, 2.15-dev, 2.15.1-debian-dev, 2.15.1-debian13-dev, 2.15.1-dev
sha256:a3451edbc1f3b7225322ec2bc38a995909d1b28e41c591050b7dbd52c4721b5a
Manifest digest:sha256:d7dfcd71f6678ef1184e998f4163f4f2753da95d0e4fbd49c4f8342740b8417d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/nats:2-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/nats:2-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/nats@sha256:99b6a3810e7be1ef650ff9f5cfd3a64efa173cf014c5398ca042dce1ba046cf5 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/nats@sha256:e89f072de9dc243b1a4ba2e30e35cab06137aa9289d068dbfb64e389509c8b97 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/nats@sha256:1c1201fb1a0984fcddab19d38044e3376004dcef850368bd8daf35303a63dd02 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/nats@sha256:23730eea0cc016a5f6ae49768c0aeec28acaa17849b3c7478fb9e73ac0e4fff7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/nats@sha256:64ff9bc4997abbe521c89d8817b642bb3e10123f31a45d27d9bbe2e249a2d903 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/nats@sha256:a2db30e5b3d136b587eea818af9476ca365cbe6138e2682d675dc05f4c6ead3d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/nats@sha256:d5117805d23423a503bb1fdb28b8548598d76b4427108cade986ea3d16e51f9d |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/nats@sha256:0ef60e7a25e1b5b40f1529f3b40bbaec7a18b81c7d4bc1274e010d37e0f919be |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/nats@sha256:c7a5f4851395bdbf66ba3c0b30882c3f942e12406033a97d160e1023a1bf402c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/nats@sha256:759d9a122554b5cd8a1d04d89d7542e6221166dc912cfe13881d43617f2b84a2 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/nats@sha256:cc2fdafbf26d6061fee3c207a19a53757165c13d01ec79a627d18734663afdf4 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/nats@sha256:6c21903631348e952abed32dc72ba497e0184600075f0d6d029b6c7a4eafde84 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/nats@sha256:4fc6567b2ea828d2e4d234969e0f5dbcd3f1a34f9a49143586c88057c12b5c3c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/nats@sha256:56bc7d6994d5890e25eb52a1d87098285f59a1866f0befafc0662716ca40763d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/nats@sha256:800028a97e24b00ca0f0a18fc2377a878f6a5ecd5d4943947eaba581c9e52586 |