dhi.io/nats
NATS 2.15.x (fips)
2-debian-fips, 2-debian13-fips, 2-fips, 2.15-debian-fips, 2.15-debian13-fips, 2.15-fips, 2.15.3-debian-fips, 2.15.3-debian13-fips, 2.15.3-fips
sha256:911b38bf44eaa2ccc69b0c2915acda99c30444c9dac24ceb3f00b432afcf07d8
Manifest digest:sha256:510ff5b6e00c0e650e6f1b130d59e1373f83e5efb3898a64b6028ac3e242ad7a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/nats:2-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/nats:2-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/nats@sha256:b0dff8fa397d690cdb08d806111fb02d673ba91517ace8d734c0dcc86aec50b7 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/nats@sha256:82072569383360b2e15f61cf395ac72182fff2cf110c0b66ecf293bb7a84b27d |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/nats@sha256:d59d688e6bc1eba53e949ad7c872d7fe1a8b5760ecd80c541a367deec403fbd7 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/nats@sha256:3718eb510bbcfd3637804bab65243b0bf0f3724d46209e9115534fb9deb6bf04 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/nats@sha256:1d7dbf6bb2dace6ad0527bda64eb80f1a91a81170563a7b741995f95ca953cfc |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/nats@sha256:c92a6a664ca9ae02694753cef88dfa5d947241f8ea3548ab80babfc07eb3c5de |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/nats@sha256:7b48a1211c53f169fefe0736808ceab770d91346847abcd5d40845d9dd94d605 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/nats@sha256:4e29981bcd2698308244638c4dcfd9bf9f13d8a346320ff5640a0c7b59794a5f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/nats@sha256:946198fef95f2d156190cf531624ee0638aad37fe2f7b23978df448209c0058c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/nats@sha256:afc2d3267efa93910d6c7f666d2a7f226b3bf0e56f40e2e3abeb696c06adb73b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/nats@sha256:2e1d32f259d2b3ea1a117c916a7349f8d48956bccc302500369594020a8d54f9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/nats@sha256:7d072558b1590f20b039a39e19194c38631acb1653b6dae6b96383c9262df816 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/nats@sha256:38a22d614587fabdfd78bd70568e4457fab1757392f34741a88662fc57252156 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/nats@sha256:ea5cd2104df8f17fcf236847c48c62bceb80c682698b926d479b106514eb6350 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/nats@sha256:97205052af76546757f06ca16352fa20343791b91fcb7f1fd76018dd7d2ac566 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/nats@sha256:2f6c0c64250011b32cb96838e45462917f6f28b6ea4944c88762220e57746a0a |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/nats@sha256:73bfad99860d5f6fc00d8edab963fd289b90e07c7699e4359f413c30464e26c2 |