dhi.io/aspnetcore
ASP.NET Core 9.x (fips, dev)
9-debian-fips-dev, 9-debian13-fips-dev, 9-fips-dev, 9.0-debian-fips-dev, 9.0-debian13-fips-dev, 9.0-fips-dev, 9.0.22-debian-fips-dev, 9.0.22-debian13-fips-dev, 9.0.22-fips-dev
sha256:d42a862dbdaa0dd1970f2d10dfeacba940cc87c72f9280661eb7c97a98f58108
Manifest digest:sha256:f6ef5e6fdc26e7da77feb2f42a0efe72fdad71a5438e59edfe2cd8f702c04e03
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/aspnetcore:9-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/aspnetcore:9-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/aspnetcore@sha256:803256f8714496f18bdbfc03a39b3d4801536e84cd2993405347f6a34663b3d2 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/aspnetcore@sha256:dd9becaa765f1b64cb3d9418b80baffb5921e6b3fdc451e1480fdaabd9412ffd |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/aspnetcore@sha256:745e30d1a284d8a88292440bb6a53a6da5b1dc09984773b7d65202ef3199c864 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/aspnetcore@sha256:b7c8ed7b6add5fa3e69892d12abfbb3f7895613c095e285fad53b46e634a9efe |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/aspnetcore@sha256:48217de8cbc2dba0f9474c31a99f168c5380fb2982eaceb1467ed70952cdb371 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/aspnetcore@sha256:3cf9a88a83651fbffd4f695eac45cc536ba405bd6dee9fb9d131ace6ac957d47 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/aspnetcore@sha256:7316a874a65ca2597e3fe67e4459633f6fbd7ffd2cb01320ca38bc0846593073 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/aspnetcore@sha256:b9517bb6c7aa75bece4d9278905f090d47e5ea1bae2e1e2635f98e6a4531d5f5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/aspnetcore@sha256:2ee697e88ab0d4c01730f5b56c9646ad183e3177e233c9e42e21620b7b9aa49c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/aspnetcore@sha256:8425af2f00a22cd26415e0bd4295f09b2460f7a0725d303f720e5f6431bb9a10 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/aspnetcore@sha256:16307f920d5396363c664964196c20a957f95513e7c3e203b776923bc64c1dab |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/aspnetcore@sha256:8b866242ce0841e808825d6ce8b4f608519954332375199cbc68cb292a67ea4c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/aspnetcore@sha256:6ca9c5f1de154ff9d562b5ec3f21ba839f403c566e2fdf4bf3e393fcad1180c8 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/aspnetcore@sha256:97a8aaa2744e3607a7e86bf84d77fbd998933aa5089bd59d7a95a8b7b0d0120a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/aspnetcore@sha256:ba56fef59dae360d37ba9ef4e7172fe5c1bf90d41d495c0a28f0640ef7241b0e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/aspnetcore@sha256:e51600b5bb7cc78cf2109228745a0fcbdc15de1e07e624dea72dc150956a409f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/aspnetcore@sha256:ee3cb83eb70cca93a4aabfb2dae6927304debb7cc84523862c503da9ed9ce07e |