dhi.io/dotnet
.NET 9.x Runtime (fips)
9-alpine-fips, 9-alpine3.24-fips, 9.0-alpine-fips, 9.0-alpine3.24-fips, 9.0.23-alpine-fips, 9.0.23-alpine3.24-fips
sha256:5f1f62162ffaf602e12c376217a5dbbed1eb71dec173072b66d61061d412fdca
Manifest digest:sha256:f9b12b68faa1281dd6e4d96b6feac89452b123e0fa689d0955b154b2185efb42
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-alpine-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-alpine-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:10095b869c51e07641e55a0967f83d2ae20e49cc32492ea36769b1c3c40bd2fd |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:fdba8690d8975699e8b8a4b268b59fdf12e1aac6145e7b9a69fbd54bc997da11 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/dotnet@sha256:169e0a0176ce24f49d17e67f2c130a8f1c6af08976b24aaf49ce1584c0a93f7c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:7782e2aa419c16dd9677c49d0b5dbe61fcf7472995856701c55974529a9a0f6a |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/dotnet@sha256:95f2d71e824c808d8fb6ea735fd5a2ff8396b0a1d89145f909cf6ffad96bacf3 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:0ec51de579096e6414971b64cfe5318243f0ab900810a2ce6c7dab8ecbeb3f70 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:80bc1b57224d856b45503280831898d9fec2c2ec51a139e8a12f2a309caaa3c5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:0c07ecc2b40c16b2ab2edd3033ebb2e61797f5faba6851031d0877dfb6e325b3 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:7da86b5baff7e00dd4f0d09adb191fc127491d184ebf633be8cf2758f4db2ca2 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:9bcf4bb09c2e99332be1a2205bc79e9881bf01723db5ad509e9eb268887a7567 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:e0ac26aae61e9adbef82895fde358deb50301037ff8db66fba6d4da4a72818f0 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:d08ae01282587acbf17d9cef90f36e4382f4758ad936e9ab38622cabd7481938 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:da3ce1b9cd70dae4b0bb0a11c9668f398dd5086a1906b78a09093e8736b67ee9 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:c2e6f565e19b5b29bc62c1182b5041e25af0b98e92e48da84721d4b0e00c2f53 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:7c359285956a7d88cc9b03c8bd0779dfe108d14c28cbf4da9b01283883c65061 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:596300a057530afc0fd08da3f8c91ca50a69eccb6f916795978dcc7b372e5f03 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:b5c40cce24c45cfe0a3246a8495eef55f47515ce721ec075b2f9beec255a0a0e |