dhi.io/vsphere-csi-syncer
vSphere CSI Syncer 3.3.x (fips, dev)
3.3-debian-fips-dev, 3.3-debian13-fips-dev, 3.3-fips-dev, 3.3.1-debian-fips-dev, 3.3.1-debian13-fips-dev, 3.3.1-fips-dev
sha256:5e61efde470b48668e4084df45ce93f4aa1da14493aca0de6c74f685fd07b0e3
Manifest digest:sha256:4232ad166d42a012a3e6b7f23b402ba40b4603835fbe11c1e708aa271d6ca58c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/vsphere-csi-syncer:3.3-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/vsphere-csi-syncer:3.3-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/vsphere-csi-syncer@sha256:6cb265dc4b537a3422fb7bc5ded5634f955848b309b34e0b02438a5cab55853c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/vsphere-csi-syncer@sha256:e0ddc1f383c392fdc971edb27a3ac605803c470b63533c018e1ded0debb8a200 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/vsphere-csi-syncer@sha256:beac571fd4d80c4f3865396c27c799f467fb7161066a08f9a69567d820cc4214 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/vsphere-csi-syncer@sha256:141f3debfc84a28cb2236d5acef1814af00afd5fd825863c2aa50bfb2d558619 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/vsphere-csi-syncer@sha256:6002febcc5582a7fbe2c30f020b08db888d9268759365d1ef7f7c2193407b978 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/vsphere-csi-syncer@sha256:cbdc2c38f55d05cb40a641abf3d0e9f5f2aa9c4ad0d3bec310198386a4e8b341 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/vsphere-csi-syncer@sha256:d2a22a962bc68d6a466c2dad0853e0be35a4fa9d6ee80050ae4fbce6c0003226 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/vsphere-csi-syncer@sha256:dbf02ae3afcba4b33c6f88c623d37d164a9cf55fea41d01ec8271fc3a5e9b435 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/vsphere-csi-syncer@sha256:fa0ee8ba6c7dc32d2b99280c3161689bdba7c957493ee4ed60fd56d53f7bb12c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/vsphere-csi-syncer@sha256:a2e84adc7f660d5d76f35f26079aa3ec9ef6163cd6bfcdceab37c7d16aa3a69c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/vsphere-csi-syncer@sha256:45f1dcf40533356c9399a799ad36c755808423ddb6392aa7ec5ae17378d73e7e |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/vsphere-csi-syncer@sha256:cb22ba8bdbcf8f5555879c90235dbf154cab965b0647f8abc922f1a45ab6adb8 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/vsphere-csi-syncer@sha256:107c1e3f345974e2fca6c229553b2f66be736900a6294078a7c832ca79ab0eb0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/vsphere-csi-syncer@sha256:9df9acba951822099ca12e99f5737bfc4047c46f389d4c12d8345110a8017ca0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/vsphere-csi-syncer@sha256:f988eb6709c6028009d35e7e86bc4a790fa687113ef5b5530fd2bf3028131ade |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/vsphere-csi-syncer@sha256:4ff8664eaf452680e658e93377a4b23a49344fc309a260c97cf5013127eb927f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/vsphere-csi-syncer@sha256:ee25cb17bc4b1b8e5db5a8a29f7fded7be415522ee46884fd27128665febb414 |