dhi.io/sapmachine
SapMachine 26.x JDK (fips, dev)
26-jdk-debian-fips-dev, 26-jdk-debian13-fips-dev, 26-jdk-fips-dev, 26.0-jdk-debian-fips-dev, 26.0-jdk-debian13-fips-dev, 26.0-jdk-fips-dev, 26.0.2-jdk-debian-fips-dev, 26.0.2-jdk-debian13-fips-dev, 26.0.2-jdk-fips-dev
sha256:b116d15ae696be11458a60e2d889a79593f40d8a819b080afab599467f116e31
Manifest digest:sha256:cd5d96e37f4a100aa0dcc434081de5ecae6dc1c1797cd2bdd4ffa6d5915e1942
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/sapmachine:26-jdk-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/sapmachine:26-jdk-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/sapmachine@sha256:fae01d00c98bde9ab78ea15f02ac2f83a1b802dfba5bff6d4df8abbb9499d2a9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/sapmachine@sha256:8af68aada4b3a12ea56cf00c7e92b37f8c1b726b7448a1b0c782b3739f0ae6e1 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/sapmachine@sha256:722ba13a60bc8651b9d9e91a446bff553a5c7e339d94c03ad4c17e4b134f45b7 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/sapmachine@sha256:7de015fb347be0be80ffadd2747a142576e4d982474465db46a99b349e0cc05d |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/sapmachine@sha256:d12dcb03d72bd467197952f841680d939c440cbb036e630c7a3e7ad3134dbbc7 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/sapmachine@sha256:06b97e7f1a6faa3748078925e27af0a8666686a607a9ed0be6fc26803c353cd8 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/sapmachine@sha256:979eba707ca2c4654f7b77189e097f8c718ca78c1ede1253cc8c6b6152b32659 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/sapmachine@sha256:ad2cc37790e3bca70f7c9f16cb48d3eb2261abd26854d64c3ff5194c7729045b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/sapmachine@sha256:27132c4f7cd854d3779ec8cf4e722540cc42614a4a2e6ca70a5a45c8f3c43e00 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/sapmachine@sha256:cbef38b26acf2911e453c3d6ea62a7cbe47fb593d105bf16cd2d8ed477369b38 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/sapmachine@sha256:f4cb218089c61ad5f609ae5288cb9c6906df8efde85c610916c5d4f62f8a1169 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/sapmachine@sha256:4af2f977604914d4ff4220d133655f12ce0299f3853f5e218282d11a6855ea20 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/sapmachine@sha256:18084dada650d2f13fa55d679c380a170f6c81408119ac2682ed4364809b73ff |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/sapmachine@sha256:ed93673dab03113905c989cb359a1106979545014f37c0b85d54a94d318b3796 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/sapmachine@sha256:86c6acf22033591a4e5f99e0f8911010ec3561e976dc25506414b011c9ed8c1c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/sapmachine@sha256:4e421f484d611465ed3694c0c048ff3cfa466326e529c800c8f786735ce6617a |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/sapmachine@sha256:bfc026c1b107b04a32935ac65e8d9efb472a6978ed1478c1bf25541a62200629 |