dhi.io/gitlab-runner-helper
GitLab Runner Helper 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:8d489bac346fe4f3317511b588807d590bdf86c92091ded75c2ab0c7cefd11e6
Manifest digest:sha256:74463c77ff484073f9efbe14be4eef6c0341740ee3430df6dc59d9b9403af785
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:c6a7fc5064e2499db05cf50504b0c4acf9a4f4e6d4063ee1be303394e9b04366 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:0d9c7fcb4a2754a2b6f6be3fc1b8f70366d6a12e14109e4af141c06471bd6a50 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:62e55e253c7ac376538f03acb1eade2e91f17e6b9afd81201f954693118a71d3 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:89bd23ca2cb47b1f374d1680285430d4b1b8fc15949d47caac22f8a960ea0922 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:94546ad714cc0874d4e0014203022b4c2212e30831951c7e2dfc7ead885576e3 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:930338ff15e7ba8b9d3f31e0332ca488b207710a8a8a0305c985e31e8b2b1870 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:9ec94872057d37115591b7ecd1407f6b56c894a6ef4aabe8978f5987a436afea |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:e3d5ad5ebc03da6d8043c9d8af14b33c7f973a89cebe3614b02ef819712f7f82 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:c30e04b995c3a430259dcbe3ce17a828cc489ee4ca0c3c5a18f8434b5d13dd08 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:a0641991ea95192b23c68883cc91a230979b5e0902cce78d7c0168e581e0c21d |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:ba173fd790a91d079ddef01104a321b79e8edc44593db8bc33e6c23d4d4687bd |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:3fceee5681dcb4b729ed61bca2cb3f06cee304f6c208557a15431bab6fb140cf |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:1c643de37f2df6e6245f6769dc3c6ff1181f12a1d67317b330aa815c53e51738 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:1586703fa7f59d4b110a40462da6c7cb652e4959cfb7f631c1c730b13bb70f3b |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:57423518915512c9c0d2eb1a5b0509383525555c45377d6da1cb732da54c0c96 |