dhi.io/nats
NATS 2.15.x (fips)
2-debian-fips, 2-debian13-fips, 2-fips, 2.15-debian-fips, 2.15-debian13-fips, 2.15-fips, 2.15.1-debian-fips, 2.15.1-debian13-fips, 2.15.1-fips
sha256:21bc8d7aa6875c79131139e97f952e8ce0a842e031dfc2413be119b2dadd5af2
Manifest digest:sha256:825ca8eb1cb719ddc4888bc6c688451cd596113a00ffff9795ec4ca501ce96ce
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/nats:2-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/nats:2-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/nats@sha256:def1dbac5a30ce1a4da04a4d18a4385980f52f1ab2185b0474bcc2029d9d5178 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/nats@sha256:a4852b4fac6d0c2367bc0e0c69bae5f2aa9ae6e3ee46720c1d558a391f61386a |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/nats@sha256:9f936a12f1df0acd5b174261495ba7e4ece2dd8bbaef9f544dec8687def89ba9 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/nats@sha256:40c2043a7a74703bf5f3643c76c57b797ac297d9ce0f03671d090fd70fd7c393 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/nats@sha256:616ce2c6700c6c51c86fae15ae41d390b621c427958fff4fb7a035c00484be87 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/nats@sha256:adc7e3c3230b74d258d4d23dcd21e3d076b28a6b7b03bb3dfdba0e1a69dcd1e5 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/nats@sha256:24c318c345b42762f2aceb911b73335441d720c260482df633652389ff2a95a4 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/nats@sha256:d64ae707b7ccc2aedc15658ca65292a8296fcfa844b164c5f75902517240069e |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/nats@sha256:731a5be22f389777c310c0c6ddb8b60a1f0cde841e87a9d51da5df3c8ebb6589 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/nats@sha256:150aeb5a7ea60d4bf066294a790fb1655a6fe87c4c0550367bc03173419fbe10 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/nats@sha256:6d51f73a11c4d127b3291e49c207009dd589b576a4802ede463d43ff06fcc142 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/nats@sha256:23f32b7cc037d3a311e47b1ac7e183a45759775884ac71be35074fa04406ad56 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/nats@sha256:87c071f5fd5e16e44970ebdcf5f676fa61e9331aba04acfe900e1585f93a82f3 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/nats@sha256:861a200c6b4f7e3092122b3fb70b7174d07d3a2987aa5cf3ef49d8fa233f222d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/nats@sha256:ace1ba6ecc56b1169d9ad7334d0fb811e3e1a732defc47eaa1023c8914d4407b |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/nats@sha256:9b7bfaf3e5a80c67171fd751e1f376f7516a74a4e15a99de2f37cb4f6400e2f4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/nats@sha256:6a4c91e4f1c9efa900355d96eeea88a95b245cd5cd42802fb9160e2c7465324f |