dhi.io/gitlab-runner-helper
GitLab Runner Helper 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.0, 19.5.0-debian, 19.5.0-debian13
sha256:e86f5b48aade3565cbb38aa85ba498556f9b14a48418e629a91c47179391cce5
Manifest digest:sha256:a884ca6e9e24d45cd04f5f63050794bc8d9edd54814160b7491271d21e1ce58a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:e6db1b67b3d72422db8d9a44462c27e55beb3203eb36c396ab0c546c01c642a9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:e835c4d5d1da5878c9da860d20141087b8245ade23e4e063826c53eaede5056d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:fa65929267a9a1c1433441aa8bac6712dd2fcea825b5df5bd1202b567e9a2380 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:b94a942befb6d02b0b67f5b1cdbffae570631e958d8eaf01f69b02085ea6660b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:d5cbd80554126fa2a746dae1bffb56754dde590058525bfd52fda8eeae5d56cb |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:a9e8cfefcb1e17e4ea485906fa7ca710c5172b8bb6b9a44a5229e2b35a151857 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:defd018ec13cb3b576e46358c38668f8d10553f0b274ea22a3f735979274639b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:49b1d980cd31e602a7ea03eac36f5e6cc42d9e391974ace1f10e6a7353be787a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:f4385da91ead84087766976bf879c1a8bee03af7bc692ea2b8e1515f24920ffb |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:0f9f25ad672f4d696917340d960fdb7d5310e1e68d07e347fdbb1b2c451bd16d |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:d28d1d4ec09cad0590148aa5dd4041a886b2a06ec64288c3b76ad3760b26e70e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:9ae30be23aa16b8cbec7a63983373d8b3e8b2f56bc29aeaaa52959a7d0bd3ea2 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:fbb2c9cbfe4036a9fcd02b3b3f5f02af814a52afcd613f62be3fcf9ef203d58f |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:cd4bfe2add2597e96cb5862f7f5ac957a06e80b1480dc510843b4ca5372cc1bf |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:5a2c74f805455069c9fa669755558fb4490e8ea01662a161c00c7f07de552907 |