dhi.io/gitlab-runner-helper
GitLab Runner Helper 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.1, 19.5.1-debian, 19.5.1-debian13
sha256:c6f25efdea24372557c87a729bf5d688f8e9e03d7697e4179ca8362399b77f14
Manifest digest:sha256:910c27413888817518bb4a2bca46e004e4c5f4d9b0d469fa91eaf1a05aba70ae
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:f991201b91a7664f380ff7fe2a36477c985c658d6486178b87b4ef589a039d9b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:ee0072012c948af793b7d2edaa3dccc30583faa2787084325ff5f03b48cb2098 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:2cda6f69172b35529db84463c263dbd9df2b65e6fdad8b400ea7cf41d7a67426 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:404309a3e70da633794abaa02d1cfddb3c32fcb414b19877eb9ac53b93990415 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:2a68e0972a283471952f911bbd2e59c0f77268fa92209530c5bb2f4dcdab2cb6 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:3be96160fe3e67f3bc0367cd7d9b0d70f400711e75e64176320a11cad9a46a97 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:d2fecd7a61b6335c8c0cf402986105affb0c0eed30089fc2954aadcd6bc299e3 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:1645debeebe02843f22f330f9fe241ac1ead290776479716661b29aa32727cde |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:e1ddcf069b1a949f13ea9f04f630485de696d8bcb6274c1c27f90fb8c8c52bcf |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:ed7f81002c424fe945448f0a37460a5cb93833f7aeda617b49ef5a4688dabe98 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:bbd5dec163725ff91e7030128277c3348df24b5af8e45ff61510dd14c5527876 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:f29088aaa72971e1da7bfd53043152ba633bd610b44dcff2201cfdc92a577519 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:0aaf51df8618271b317d7333b48aaddc59cc06595b025e405894fa8ab6bb7fbd |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:81ffbc9434284b78c5d5064a177752a3f65572e7b40489dc7cf6ea5eb4d0524d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:23b785bc84df22bc4a4b730d42d1126011a613853498ea4e5d810a9732db339d |