dhi.io/nats
NATS 2.15.x (fips, dev)
2-debian-fips-dev, 2-debian13-fips-dev, 2-fips-dev, 2.15-debian-fips-dev, 2.15-debian13-fips-dev, 2.15-fips-dev, 2.15.3-debian-fips-dev, 2.15.3-debian13-fips-dev, 2.15.3-fips-dev
sha256:47db2e614ed4067875dd33216fe20196ee344b67c4d38d75659d7a0dcb0113e6
Manifest digest:sha256:f4a2f0746dac3c9feeaf5aefbfb37be947762b833fff6685305bbbdf4ce57396
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/nats:2-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/nats:2-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/nats@sha256:2353c88053966aa601e2e3970eb0a51bc9036c5244ce9eee172af2d81d5acd73 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/nats@sha256:80a165f8420cc199f2f0cf316af6d5f0fa3b847c1ea60b686cd157f515d6c06a |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/nats@sha256:5d0c9652768ba9f6e5d447aaad14251f1d712974f5530d86160dec9cc3fa7e7b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/nats@sha256:e284c171524745bc755b35a5b8c8157d425e3769cb7f4f073b87c9fa42fc8198 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/nats@sha256:8203e04195d6d1558b52e829e9f3c6a913e54e036c8869e64d27b2fee0f715bf |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/nats@sha256:9695b9d079770ac71ae606613eca004cdcf2fa1c0e51204000bef3af01275269 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/nats@sha256:28a3a4dde227602cd55e2bd0ffaa87c8502436a3d312e55106e3228515a44867 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/nats@sha256:866c8e5a87957c2b89f88490c0f9c3ab5a6fcbc79956796191a5525c35be5e7d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/nats@sha256:1898fb1811996323ee85aec997567d17463eb6abba5503c85e854996c140ebd6 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/nats@sha256:37037897cb6abd08974a64b85003613bb556475ae66a904d36f1c5399e46002e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/nats@sha256:674f0c5ce07d96055b0a5c6a3e9ab8ca1d16b843ab913b5c2773a02729b1cb68 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/nats@sha256:241ac4ad4f1d0f80daa8802d7989f51fe422b264a69818a071740aaa606f828c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/nats@sha256:1186ad5ea2f4e895a07cbe750847926d689f2d978401370b47ebaa67dcfd6275 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/nats@sha256:f409914c1ca0e765c4cb215a7510ddb47c670b6ae31860c59038133bb47140ea |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/nats@sha256:4bb340a3d7cbadcd22ec7ec4f0aaa561c196d288f87e5fd345987f86bab57372 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/nats@sha256:1c2688d0b1e23868259eb72c66a3f4e68c82facb8b44f945834f9cf76159c851 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/nats@sha256:c28f87b3e196ad63a8ccd02d8366f48f7e856cf5c2e8b11b448f6fd6b63273da |