dhi.io/gitlab-runner-helper
GitLab Runner Helper 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.0-debian-fips, 19.5.0-debian13-fips, 19.5.0-fips
sha256:88b129f109c5351e10be8c1989771f16205589c86b055d76640a347f9a9c0552
Manifest digest:sha256:688d71b1c7a4671bfee717a66e1de4c2c08f01dbba4a09c6d9a8cd154bc0c4cf
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:14e0a97ed06bcc20e8421c25cdbc37b37e170b6024399e072e53cb0d8cca7c8b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:4098f7dadd040615960c92066f03ef245f2e9a413ac4da71c538e8edb7cfa2ad |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner-helper@sha256:4286032a01c82795c87b55b2cad74439083bb6487bb3cdec3fdf3f106b20409d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:9b576e09c6f6a3f200283178b8c11684bbb0a86ae6e5870f4c1ff416377e655f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner-helper@sha256:1486dd929b3a40ac59ba3d2bc45166682160ba9096b658fc6ad31abacc837702 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:2b6d03a9666ee3c0f985db683c2778c6221c932332918e31e758821d76f31d68 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:b04a03b543609fcf7f917833f1830f6d9c935264d64f9c7ccf8213777f681b43 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:b528f9e47de70571c5d1c3ab9e5144cbc533fce3c53386ce112d1d3adc673b60 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:060f03001531ce81786f0dd5191ef199aa23fecdb4deb48ccbce9681a8b50c29 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:3359782cce01c0f36a5a17939a023871d73eea3b5cde9df6b372bec75dc8f847 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:b469a63746a040b3b4b746019b432d2a2a189ac2ca18b31a40c28c5b7825b9fc |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:65f845d329eeef41766edea35af2af92df1eaeab5cfc7db3d040633c7bd5a619 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:6629d40dd599fd7829c51365e08c5dbbe9ce0d788e80ec2e5a35f3387ff4296c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:7b7e820f34a90b756eb3f2fe6dcb901fc4b184c810f7180bb335e6e8b3297630 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:f01a364781e4e2155d26f575ce5bf987a8d289df66548034345255338ba26e8e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:04eb7d1c9ea97600c6f54563f1ab749c569f9d343a3831fc41f99cd5e7f80488 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:a1bf6314593662fc004e171de26c87bf5b420334ed369e72eadbbb076b1b9b00 |