dhi.io/gitlab-runner-helper
GitLab Runner Helper 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.1-debian-fips, 19.5.1-debian13-fips, 19.5.1-fips
sha256:a4e4fbe52e65ed2a9647fcc5a85533ccebe48d818a3665ff9fb310bf0b0b82c8
Manifest digest:sha256:228e4d2aef49dd8fac6b267fa8a72a1ca92480096d105b9569e0c1df5bb4cc77
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:064c658fbae92d0666ae7cd56054eee133ab6e123a25d4703a59fe41cbb6750a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:b3bac35479022cb29bd70f0602f676508942944bc57ccb4462a8d276a41d33da |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner-helper@sha256:7edf5efdaf4f7080af71487313399fca84ad35d4e71442c0136273fea9efcd32 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:6df410c5cf5973ee9acc7c107373c44fdb6109b64fce1d03338c6a6134eb2bc0 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner-helper@sha256:cd2c7de83605259fdcc2930818c8466e7a0fa9dc0393d88110523e4f555b34c8 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:ba765f5eeaae02322225e1de8a2a268b6496ee2dcb630649aecfe956b50a735a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:1441c833b4e1ea0bdda7d0aa4a9c9a8a186f609d93329c6209c764da622226f3 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:fa84b3727f678108eb8666e2a9e3362c4e6b1852dfccf3b5aabdfe740a7b2053 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:671f71fc970771531822bedeacfcce3121805d43e789ba5a1f6a835160740fae |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:fedb1544335ec87e0ebca05e65bb7eb77ef9aa90240b6d3565b68dc151378fd4 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:195216c72e78412d29af02b6f93e6c535412b900593ccb6dd75ba8b36f2fe7e2 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:a5d674dd8cf9ec998d498d8d512f61975dd6062ac1ce0da74d67db3132b8f2ad |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:3b2f18598441cf200b9d51b792e7b9bd26db4fb961f12bfdd8ecf3c34cd36163 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:f44a20f1f873e894ebe8debce16031176f414258114026a1e0c5b63799fd69e8 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:58c48d3d5d45d65607a4b128f5de77d003be688dda51cf3aa4fd5fe34c37e8cc |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:b55115856e6ef15ac09f8b33534c6763d810d9a9b437b86c64bb860e467c5ff3 |