dhi.io/gitlab-runner-helper
GitLab Runner Helper 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.1, 19.5.1-debian, 19.5.1-debian13
sha256:cb380b52cca16d08789f02c53bbe2d76c57b58eda6d2a147f7ad433b476b1fd9
Manifest digest:sha256:a7c3917c517e39e91d7bf7a743e568c783555d384b6d606b8317393bdfcb32ed
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:704c016f5e514b05ea36559d625c6df4e806c205ba93678512a60f3eed60dbc6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:b48eb3331252f6b0ea61c56aa65a73eafd4997306fb6e006c5ef984d5d080a0f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:4e8787161311289d2c080ae688a8b6d0fbc5b29dfd42f2acc23517de7db1393d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:ab655c7fee1a86997e3b1d0baebfc48c7df253d9686d5168976e55aeba095148 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:9c93ceb4308c770e154d0e97acc5206eed96bb213ff1b296c498ab0b8cc5c42f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:d0c32622fe61185777417fd8f3a37828f00956114e059d1aa11663bbe5e47e60 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:765b5e5d11becb7378ca9e7e0e072cb5638f03b45079920fd7b5e7587a837533 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:c8e3503b284d258a863001c0a8220451055625b84aa8e503cf384d5508657e13 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:5cd3faf90838f35e42320fd5eff4e28eb3abdfdd1568dea1330061f75be9dd93 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:5e951244c194f6629bfbc92442a13a22ee9dbddaef1b8f1c1430d4354915a49e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:bbe223892be6a638bef32f73c7ea6ffd24d3de3469cad96d3a6a9372b0cce4cc |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:7dcd4c33c3711c104d0a9d3b073e9e46a7352894488e6e0fc4aa781be74fc6a2 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:152f2d8aa6db12fe728df24f1b619a6cf847b75fc09e6d2894dca092bf85b8f0 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:ab489a2c8b3756fbe5859ee5b35ceb45d38ffef14e77f92090cd6c33d7c0da6b |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:299931ca1d5025861955260b074948bf97ffbd445f9030e96b8f40275e5fcd4c |