dhi.io/dotnet
.NET 8.x Runtime (fips)
8-debian-fips, 8-debian13-fips, 8-fips, 8.0-debian-fips, 8.0-debian13-fips, 8.0-fips, 8.0.33-debian-fips, 8.0.33-debian13-fips, 8.0.33-fips
sha256:5f4c09bf7c2eae2632ae134acafd726b850419069e317b8041bc8ad03c275449
Manifest digest:sha256:7019f4ef3f79e42ef83d80b97d54d5aae0eb7be47569eee5dd9974ce75fbc5fb
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:8-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:8-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:3ec5555f6ceb931267726c7a8c0a6f0de6b9f58fce57fc9aa3fe9fa3a174fe20 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:cd880564f00e2d3b457f3f2e4fe327b9ba97eeea230abf2678110b18eaf3f47f |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/dotnet@sha256:f634a1c8312f5264fe80bfaf849c0dff6506d9241a95f45639d2526805a7080b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:c9987c85cd278c8003c2e4fc4c900e94e1382a45b4cfe45170aea5b42ca2d03b |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/dotnet@sha256:12efb87a6804e7ee04d6dcd57ac2207ff516a1a2bd9e3ef9d128514a5c3e0bb1 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:1f3dfcced29148dd5768ed5d8f16926815ef3b6808a6369260207da78bc1806d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:29e379ff1a6b134f3feaa8109d5225add463da941fe4a1ca1b4914302c27b3a5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:39360fd3783915df60a2dfabfa5bfd2030eb40288995445b48dd0adccaccde23 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:2abcd0414314bc6b6b1054f7f5a14c680be930ded0d7cf1e056dd16ee0edc5dc |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:c1775325c3d1f559562250de6879a8e7dd6a578d23a1b4091b426ba11c8c6b04 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:a3d07df880767f9feec16894be71217727afea6d852d422fedf1ebcf4b25c269 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:9e1c75ff797a8a6fcc630c780871cee3d460eee436e8e3af24e06078abb25ac6 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:b2a6b819c6bbf8c75e307f1bb8fce31a061935cba01841f6f65720875e19af56 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:7c90cedf661d0ed778f7ea1eaf10e8348a751e40d878bf207f64eef893ab91ce |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:c315c4d8bd2b9654fae216928d65e5cb77bfa89e5e757d037692c592174e3b63 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:1bd19c46f237cae363456af44c0c8a7dc01782261ba7da8948ded9d1ca3c0c23 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:7091b9cd2cd923b890ba2cf142357b58fcb575cde24247541e886269922dc180 |