dhi.io/vsphere-csi-driver
vSphere CSI Driver 3.3.x (fips, dev)
3.3-debian-fips-dev, 3.3-debian13-fips-dev, 3.3-fips-dev, 3.3.1-debian-fips-dev, 3.3.1-debian13-fips-dev, 3.3.1-fips-dev
sha256:0ea3d74f4d02db43586864134850d36a1aa18cb7fa147ac0676d1b248e272252
Manifest digest:sha256:a2c318bdf7b4ae57f8bbbcf3f639a46d9f48b356239ab2e31ca68a90dc4035a4
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/vsphere-csi-driver:3.3-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/vsphere-csi-driver:3.3-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/vsphere-csi-driver@sha256:b077a90245b80a72ce4cb1573c08535655ae58d4541492ab7aad0f27689ae766 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/vsphere-csi-driver@sha256:8e1759ffb86138e3db657868e76bbe5d1cf6912777d9f91cf79e06c4030a6d9b |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/vsphere-csi-driver@sha256:caf19ef113133713b0eefaec7a147c5288375ad889e68b32cf346f59a0619691 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/vsphere-csi-driver@sha256:3ced595047d7540fe2af88417e18ca1f7dbeb4737afc090b4eec14734c1aa524 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/vsphere-csi-driver@sha256:2ef3eddc98f4718cae9891525b9b9d30569b4c6a4b152f50ddcfa21bf023071e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/vsphere-csi-driver@sha256:817dfc0ef7826aaf918597179ff89b6c00941509b0e874d4e3e531360d776153 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/vsphere-csi-driver@sha256:e588993edd75db1f2c00e1822c8696ed399d514f959e9bf63bbbb516f64b4593 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/vsphere-csi-driver@sha256:5ee93b38e9bbfbe38ae2f732213b53c7949826341c40b0b582a305b34aeb66d3 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/vsphere-csi-driver@sha256:ff6b7f3eeeb1bd618c288244b3769fa44cdb1649785ad8478c430b8d752997ae |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/vsphere-csi-driver@sha256:e9ff6f91458d00ffe4e4b3cf30a81f538e5437953cfb95773d0f4d9c9c1c6f15 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/vsphere-csi-driver@sha256:0f0ded786a92dc47ed979f8970693256132d7bb366a457b153b8d5205965400d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/vsphere-csi-driver@sha256:7a0af864d1f5bc026dd4e908721b21ee5951f0093201a4de006494846629e5da |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/vsphere-csi-driver@sha256:dfab8007af1fa1b5f9f6e52ab8511700a4a4456c544b7414b52938f2a8f27c21 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/vsphere-csi-driver@sha256:dd5611d2b038e8bf8a54c646f4127e7302524398c86f10a6f97092d1fccacea0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/vsphere-csi-driver@sha256:129bc3e074cfa7c188539c7947ccc7e71ceee7b02e7821ca5f9c3339620d378f |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/vsphere-csi-driver@sha256:ca37226f3f8eedaa21a555f0ddfb3f96f48740761e0ca2647ac189619393a90a |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/vsphere-csi-driver@sha256:36f822076968e6d8c3e7eb3ab92e4c4630efff9e90ba6a113542212fa3f7b4f4 |