dhi.io/sapmachine
SapMachine 17.x JRE (fips)
17-debian-fips, 17-debian13-fips, 17-fips, 17.0-debian-fips, 17.0-debian13-fips, 17.0-fips, 17.0.20-debian-fips, 17.0.20-debian13-fips, 17.0.20-fips
sha256:1d47e04dd086e0cdfa1b00a925bc14268e9fee5a7cfa16ed531726e0d25b1762
Manifest digest:sha256:4cca312f2408434188fb3bf40a701da40f5786342e8c06865d71087d5e45c4d5
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/sapmachine:17-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/sapmachine:17-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/sapmachine@sha256:a042f57e1c8f542e9574e4a233c3255afee3e2ea2bf1d45c1c3439793666d638 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/sapmachine@sha256:c393c7f7b4fef00569a0da2f36ddeda3ea792a34a994acc445aa2a18f3f062d7 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/sapmachine@sha256:ca7719e6aef9762d202f5e262e0beb9081c7e1ac93b3291f76efc2361be68023 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/sapmachine@sha256:e10ed9a8eebba4ddb51ae30e6613b82f6af263be3b691566328695e86d54d03e |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/sapmachine@sha256:9e4a1cb13625387882973b1a0c314488b2b7da07a46554afbfe8a3581cd6927d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/sapmachine@sha256:93a6bdff6b3fbaeec48d813bf60be4fcec815948c2a121c875d4100e7592fbda |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/sapmachine@sha256:0b19be6ea4307ef5ab3f863432fa67fb445225facf04c93bf0824ee6a29ce073 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/sapmachine@sha256:a4fba7ce25e22011afbbd559397a6b3163df7ed47f1337c2930ce82945d5949e |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/sapmachine@sha256:a51958abc3e1eb7d919616498097a97279a16faefcc4135f0b3748222de0ce8c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/sapmachine@sha256:417cdd7be97ee01123dbfcdf6eae7fdc0d1a42b2f08d2fd2eb90f8ab0b092a43 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/sapmachine@sha256:0641e2495db71c4b8e3f8dfdd47d8943e43794c3a080e6ca9340c341e1764ff5 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/sapmachine@sha256:5ebb240d3f67f7d621cf07c8de4ff2c070c92b19b7a97a7cd99b7f5e1334b392 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/sapmachine@sha256:298890032e863429995907362e490e47c61346f61e86c29788aa8d92b8583685 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/sapmachine@sha256:738122bcbf38749ecb047c8fea6705dfa3f8b9515be96ebba9bc327f578f862c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/sapmachine@sha256:ad249e43c8a3f1590fe77662d9e6a5c1bee7d998f6ea6a6f0243cda6925b14c6 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/sapmachine@sha256:4593c62a90e40795ab31c9565ba4b5895b1f660f31f282ad7bca377ac1b85441 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/sapmachine@sha256:e827a6dd4a71b9f74226d4db9ca5fac3328708fda772685e683bfd3297f6b275 |