dhi.io/gitlab-runner-helper
GitLab Runner Helper 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:8994565f4460dd7839c2b3a15cf81a657f4bf2d6629fd3a95c46659e8454b57e
Manifest digest:sha256:ca230194dade332a1af6cbc85d45386ca6ccced5073187364debfe5324e1d409
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:6cbe88d5484cbef21698ba11780607a19adff1e5bf11cbc837d6dd6724e4803a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:ec18647ec693194c0490f35e75c36f7ec499a7bb8863fd5fcf4b15566c4f82e2 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner-helper@sha256:7f6b50ca953b50f77372cac5cee63710c5ad0fd86ec08041586cca1b04d71266 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:164a09d1e0ce9e9dc5c6b211e48779cb70c2ccf6f7dc1b1c427cc541e9c672b3 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner-helper@sha256:280f7ae983a9bb8a5bc2e293aa8b30e8585baee19a277b74d43783ecc9c60397 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:b000dbadc9cc3d03e7466d73d0be7ece5dce326cb0f5071da162cb60e8b9f68a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:0874ed813564a16500c8a7ad26d5c60f82d8b8cc13591948ca9e1cf0550c2dd4 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:a33907c8d1fe9d6f71b637679999aacb1d8502bb48b696a4b948a76c238b1648 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:05c579f63b37326788df2dd3426f348c195b9f5ffac81f502629acc444e902b9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:d0ecbd525922803a82ba7d48e9e7408904b2a3833e010c6986754c4996689865 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:53a20bcb59f61041c053af2562fcc2eb6d952a1cf00ff2af93218e9583b94c54 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:6d90d940181f6789783f69157f3f2a5a3638576ec02a47af30549e5218149684 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:fa277c7db21a26c21a25233e17d6665a5adb9b45113ed4b1dd404207b051ff1b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:c6fcdb22d4a0b88bc3049354c8c43b7d389782c9620d6c96f9ddafabcb01f98e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:a245c79397c992067ad4df81a94a336a6ac4cb03c1fd725056f74d9c255dc2df |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:35211a254fbae693aacadacb48367ecddc2ebff951deea2cc130b2a4d2f74a69 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:9640c077885bdf9beb3988d0470da713d483386c9483543d87e0de0aa19ec899 |