dhi.io/aspnetcore
ASP.NET Core 8.x (fips, dev)
8-debian-fips-dev, 8-debian13-fips-dev, 8-fips-dev, 8.0-debian-fips-dev, 8.0-debian13-fips-dev, 8.0-fips-dev, 8.0.33-debian-fips-dev, 8.0.33-debian13-fips-dev, 8.0.33-fips-dev
sha256:fc1e84cd4001bda7e2317df9478de9c40d48d6577293c9a506eb4683254e4801
Manifest digest:sha256:8329622f0ce54ea9ca7f4c5b6ad8ac5b6e35b0e584c4fb3da8af3796ddb9cf09
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/aspnetcore:8-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/aspnetcore:8-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/aspnetcore@sha256:aa516387139441055fc0f0c1be040cba54d519e746a7e56aa749e4e396cf1c52 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/aspnetcore@sha256:4d4f09bf05d7ab72c491aec35c5118b972f65237c9c6f68ff77f6651797c2e5f |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/aspnetcore@sha256:1d317dea1bfcc485569dd95b5326a394fb35672f1cb60211aee2665587907026 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/aspnetcore@sha256:ba14664f979d68569286297beb04a8bd8fa49e86618e6d4066fdbfe4a3a452c4 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/aspnetcore@sha256:854aa8601a31ac9dd66a9629fadd1444625e8ba581bd4b0186c138dd3fd51ad7 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/aspnetcore@sha256:37ce39fda106dfb3402d52b44cc4151e03c394abe82078c0dfb605a9f4622a90 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/aspnetcore@sha256:b1351dfb5526e3f1d9b375ec64e41a224031b97196c6c1745f00fd39be3dc4e9 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/aspnetcore@sha256:64c13400324fcc81ca8676cda448996020979cd72327768f40518b5f2440b91f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/aspnetcore@sha256:9dcc110a864ec70cde55f124fdcf0efa4d941b14a2a138a2de287f279848e55c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/aspnetcore@sha256:df6799527eb6f70794c5c919cc791e13935fc616dd57e6f7d7584b638997b9bd |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/aspnetcore@sha256:7fa359956f7e3b5bc4a2e4e5064a44e030824189fc9dffff503279f4b3b78cb6 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/aspnetcore@sha256:4927baa2062bf3ee7ed05f498e60fb1a3742c07dbfefc93b0747fd0cc2e254a4 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/aspnetcore@sha256:88de440f5435b6911a61f14b0e735dc13456bdf5d706d829e75728199f4f4da6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/aspnetcore@sha256:7ecef69e38c037036e13f52b7bb8f59ddbd75301f650dfd629a2bbd432a8ffcb |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/aspnetcore@sha256:40c1d4c51d00b34b7e2a0839024bed0aa7e538ae5783f00da19d342ba96bb5a9 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/aspnetcore@sha256:26369a1c787f71b65f15bbe72c2c715baa22417bce23505c82090c2c424eebd9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/aspnetcore@sha256:1c4ea1227378bf37b78f9c580a13f8a0aec22a376a9815872b9d3226cd043d0f |