dhi.io/sapmachine
SapMachine 17.x JRE (fips)
17-debian-fips, 17-debian13-fips, 17-fips, 17.0-debian-fips, 17.0-debian13-fips, 17.0-fips, 17.0.20-debian-fips, 17.0.20-debian13-fips, 17.0.20-fips
sha256:df813546b7e0002381a56e2b70e4c56b83bc923ce206530723ff5b54a224cdf2
Manifest digest:sha256:797f82661e9186e371141e268401690dba53c37d05c3a37d250d6517595fef2f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/sapmachine:17-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/sapmachine:17-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/sapmachine@sha256:bffd8575db6fd16787affcc0533c3ee11f33733ab97610be31cdec4c97fa4d02 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/sapmachine@sha256:2e1e5991714a1331ee5bcd257c71c9f5016dfc561867709daa69e4c16e14c4be |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/sapmachine@sha256:efaf71bd38882cce0bfe6128227a0048bae09e655d5d11e71a07530955c9db92 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/sapmachine@sha256:0af17ee481923be33e7acf3b8fda06fc7397e81d0a2b65c10dd7723b87fd16e9 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/sapmachine@sha256:988780c5e5b13d8facd02cdce35c4043ac1b54d2a6eea5b1406cd0b9cad02e81 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/sapmachine@sha256:8ea71629bb4cc9e0eb01d5b9a22f06cf724746e46b9d06fda33d7c4ebab493e7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/sapmachine@sha256:6ff93cf489fb0de6939a735e99d4b9ee238c1f585821af54a04ba3a58ed53416 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/sapmachine@sha256:cb9616581add9766ffbcf5ae26fdad4d745633ee314ac3e4aed414b4b66ba626 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/sapmachine@sha256:0724cb5b13b43e0222c6951ce6bcfd164a2416279bc530a6bf916d0131ce0de4 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/sapmachine@sha256:56888082bf3aab911ee4f5642013e5991a104c203f9330a37aa911965f1125bb |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/sapmachine@sha256:6856eccf87f00ff6eee97fef3a1babca8678e6367273afb83e32a9d282b21604 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/sapmachine@sha256:1eed29fd53c7384192c0d9a55cc0cad8a1e4a14ccd25f676e32170cb141dd983 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/sapmachine@sha256:0cf4702ba12e5d721b4518b7816eae1c33024e64716ae6537be6266f57651fda |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/sapmachine@sha256:eb9e44b4375dc9b3d23ddef695b8321ff2b56576efc1100c6700702d45dc7734 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/sapmachine@sha256:d0c18c9b5635d4bef377ae3164a5ee0f3b5281ed267c1106b963ae9a5d6d3a9b |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/sapmachine@sha256:bb1f68ae369bb73235f0d2f9bd39d207bd06cf336e6fe9e179aaaf2306a2d5d3 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/sapmachine@sha256:1bb0aa83606650be00fd50b69be94b080de0b10d950258740b0f335bf4860985 |