dhi.io/vsphere-csi-syncer
vSphere CSI Syncer 3.3.x (fips, dev)
3.3-debian-fips-dev, 3.3-debian13-fips-dev, 3.3-fips-dev, 3.3.1-debian-fips-dev, 3.3.1-debian13-fips-dev, 3.3.1-fips-dev
sha256:dba2e52f87420e4db586c3711da254beb7fa3a3e36fafe3744960fda3602b206
Manifest digest:sha256:6f4e0e7a808ac36b2aedf447ba277199d43ff32e6ec3cbc760b5ec5904d98bbc
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/vsphere-csi-syncer:3.3-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/vsphere-csi-syncer:3.3-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/vsphere-csi-syncer@sha256:9dd1e3c28cdfc1b7208d5d8760deaa2eed38b02df29b0ce12dcae359332732e6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/vsphere-csi-syncer@sha256:f83ba4b3f2e7518a438b52a0f3afff2fbfc20f1ba17c76db79c430456c34baec |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/vsphere-csi-syncer@sha256:39c95311bcf1d241ccb9ee5e6d5a96985fd4c347e47961d78c29d885948909bd |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/vsphere-csi-syncer@sha256:f53d99d758a7cb1e98b7223a457307236a2b7d8c0a2e74928b9e38ee7da9611c |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/vsphere-csi-syncer@sha256:0db2db7682a331939ded95fd03aac4c09e97077771c74aaa6f108870c1ebac99 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/vsphere-csi-syncer@sha256:9e99b8a5112ca7981d18dee3d365e49388ca487520fc2a9460f57777257f0441 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/vsphere-csi-syncer@sha256:676c2fe57ddc45a0ffaa6dfe407545f73bebf6b2773b893b79f10beca142571b |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/vsphere-csi-syncer@sha256:993051a959a1df0b0f7a3b7defd855944d3dea7bcd8517f0b099270a4cb4f731 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/vsphere-csi-syncer@sha256:045272f5864a9b27aee0b43b7e667ac49f7386cd2c0f8d777bf02683e69c57d2 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/vsphere-csi-syncer@sha256:e6082649b2e3add8f2d2d28bdf8f12c3efbb9d56d4e15babaaaf023f25edfe10 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/vsphere-csi-syncer@sha256:a53d41c4599ccef01dfbc98319293929ecce641e14a924f77f61bcccb30d56b9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/vsphere-csi-syncer@sha256:debb9486593d72644e650f0cdc989d8892de07e99b360aad7c099ad953dd0cc1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/vsphere-csi-syncer@sha256:fd3a2d11a8c3ae3d5c6afabd3aed2855a7cdd2f5f03e95c052dfa37ab7f821fc |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/vsphere-csi-syncer@sha256:214f791fb64b51cea939310b0d6b630b34b53223c034646b536623a00c27bac9 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/vsphere-csi-syncer@sha256:561975799aca383f6d1b258bd2342fa0462c61ce093c31c241f4998783d7a8b5 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/vsphere-csi-syncer@sha256:04b1c2c22978d483d51744de44e16953400ee1366a2b3daeb9467e1171504a40 |