dhi.io/nats
NATS 2.15.x (dev)
2-debian-dev, 2-debian13-dev, 2-dev, 2.15-debian-dev, 2.15-debian13-dev, 2.15-dev, 2.15.3-debian-dev, 2.15.3-debian13-dev, 2.15.3-dev
sha256:b8a77b55e00bb597717331181fc7397f044ccd3059492501dae286ea911dc1d2
Manifest digest:sha256:a4f61e42fcc7b92755f5e318eddf5e30a041b5250635e99cdcf50badd8c16e5e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/nats:2-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/nats:2-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/nats@sha256:653f28b0714c45fc33d0c2a7369ac5df6b353f4a3c650c82e140b524c45daa00 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/nats@sha256:272b43b7cfa4ba3b5e0e70dee665e6ba1bfc9ffc8cdc0992cac16348d2a937ab |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/nats@sha256:90319f110ca519e81577b93d91350f91f64d69f5868a48ced2849c5794668a54 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/nats@sha256:28582291b547b030e437463412c668996eab18afa2286a6f94353a8104d2a43f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/nats@sha256:10f4326bf6261871496c07f3ecb461fc3ee44c9df3718dc88081929218245cf4 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/nats@sha256:5ce7be6f145c5c37b45996b6fa3148f7e7f65cef4b800e6c14451080c036bc3d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/nats@sha256:362b4d1be5cc51b966a9c5dc4aeb29a5b14660205951f58f1ef12678b023dc63 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/nats@sha256:ff1b028c121219c11fc0928fcb8be7643ccd5733777d593b31300a42e65b808d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/nats@sha256:39c517c5cfaf3376f560a042f81481708cb2fd2ca18a1ed413c63d7dfbfbc1b3 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/nats@sha256:df9955886eb85ea8ba85f6380dcf7cd01bb9e465c116b14d9d1bcc02d84d7518 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/nats@sha256:88e6e4c8919791dbc3f8590e82afc9a22b16dcba71a088e053e83cd8470694fa |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/nats@sha256:6aeb1cf02c313b206b7ccd4a3be49826ffd32ad5bbaf8a7cce758f1ee863d077 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/nats@sha256:41fd10d7d38436ac189c3584f00681992695fc93a7191e31fe7e5ac04ade3af6 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/nats@sha256:70f0b4cabadcd9d753c1996d6d4fc76bd97bd9843a4c9a84647fb69bae9f7150 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/nats@sha256:b749f50a625c7147296a265a01f1c6329723100d2ab6be24b7ba9d8b1c566edb |