dhi.io/rabbitmq
RabbitMQ 4.3.x (fips, dev)
4-debian-fips-dev, 4-debian13-fips-dev, 4-fips-dev, 4.3-debian-fips-dev, 4.3-debian13-fips-dev, 4.3-fips-dev, 4.3.6-debian-fips-dev, 4.3.6-debian13-fips-dev, 4.3.6-fips-dev
sha256:39548720bff7cd7d72e2b2c5df1d3e537c235499539c3be489da433912f011f7
Manifest digest:sha256:8dce9ebf9737a1b788f360e45f77e885ef6f5142b4584c9297a826957b21cca1
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/rabbitmq:4-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/rabbitmq:4-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/rabbitmq@sha256:7be8f42dad47606abbd089cea31d8f5daad462cb7c1a72d1b2b34d1958fc1cf0 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/rabbitmq@sha256:db47fe1ade5077086965cbe749f7ec622bf4662950cfdfeba533a67a423aa9b4 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/rabbitmq@sha256:659ef7489eb9532896ce7d89797059c87d60e937fd31c000c1ed7a7c437a9c9d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/rabbitmq@sha256:dfa2d87e6f8fb97d463872b8106f732817e010fae71a22acb826672525f3faba |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/rabbitmq@sha256:a85519fd2616a2506a6d72c7490432cc332b4ce8f2490b57ef48acb37401d8b7 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/rabbitmq@sha256:7cd65da3fd8a56f42ad25d7d8971fcc7c5f99e37864beed8a1ad2aaf994b68db |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/rabbitmq@sha256:e9cadf9f60e8dcf8c98c95f59610595655fa6d801aa4ca5bb22583f08666bc67 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/rabbitmq@sha256:2240a61f54e1f6547860c9a931ee6d16a53a54276f48b4e5ebb6f08b47d6bd52 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/rabbitmq@sha256:ef42d9497ae096f98146a1ac09f05ff6c2047a39732cb54cf441ab309ca30fc0 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/rabbitmq@sha256:140cbe687b69c4e5c96cf3e5f4e7dd9502d363e054e8bf235d9f1fb141370657 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/rabbitmq@sha256:177771f5e25a2b49b97f34b664bce29d9471698585d36e91a22db8f21eb2a697 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/rabbitmq@sha256:4d7b578f1911aa785430c835bb70fc4c9aca6b2cc977c04daa8400b5bdac9305 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/rabbitmq@sha256:3edd25169c43a2ca820ca2422a3eaaeb78278dbddf076f2648736984676dbd16 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/rabbitmq@sha256:ee00d012bcd3ec136915f19bcee802212ca1c1c1e5f93c3eab363574c053756e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/rabbitmq@sha256:a0b5801cd61b8b3ab0b5f5b528b2222584f98dfa8115aebca5200c5a83ce9362 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/rabbitmq@sha256:db5d3e096aaf05500468cc2719d755377c66adea4a9837b718cdcc50c404fc68 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/rabbitmq@sha256:297191c98814cf7b5dacd39b92f8c0139f5e3ea0df875c76e875f48c8665d57f |