dhi.io/gitlab-runner-helper
GitLab Runner Helper 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.0, 19.5.0-debian, 19.5.0-debian13
sha256:8271fd43509b24046cedb2ee291c35fd62c2ab3488ec6c95c2ae739d2df6e677
Manifest digest:sha256:8d27c068a1237efc53af15fce033f31056c80d2574bc9b0455bef588cff0b2ba
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:58e96976f2661d47d1a5cb14315924ddb41741a96cd3f8a116c078024417bd33 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:6cd55b375dd363232733ada959252b30985a5cfa85fb8eeea1ebf2238b408d2f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:8d1a665bcf8d36565e29009f14e5c235d0b31743197fecad6c8f1f37d6d8aa50 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:22147ad2bdebb8a3b8cd6cc19304e0bd4f8f12b85b5d63cbe15c0204b2fd1132 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:b3c9f33a746643bb5e8d0d923f2b6e3f45f8575ea0ac0a46cd780dd0e99c47f8 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:3b0677f1cd39d2597559991f0f42512c7178d4bbceb3e3950f74e291d8ab1938 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:85c4a4e9cf2c664bbeafef179dbe7388ebaa5da09d935f4bd18f5aa0ec96179c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:6e5abfaa73345e631cb68d32008612bb2647952c8b4449e65d07fbbe1b8143fa |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:d3887509ec4596ea2686ea864f68027cdbdc10cf6da4fdb174ebe381f59318f5 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:90762a75acebbb8fc4ba936000bc0854335bc10d11323e59b20db906394ab9bd |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:d90a6f253bd8ae4b70a01b2287cb37f74c8d43d6b8f6ecb8034e937a831f8760 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:75bc119bee685ce5c918bdff040e6b37f60ef4044f71b7f3d87cee03beaaa996 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:40579a15e56ab7e3c36b383e879dc51b1f9c2cf0b4a521ea15a145608045fad4 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:eb031e014a705d3783d96c49e232addecdf579c6b71e8e107798bffda9fc3597 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:d5231fd4c2db60caa5b0bb3722f0b042c63610882d6eb56b45476a2dbb404419 |