dhi.io/envoy
Envoy 1.36.x (fips, dev)
1.36-debian-fips-dev, 1.36-debian13-fips-dev, 1.36-fips-dev, 1.36.12-debian-fips-dev, 1.36.12-debian13-fips-dev, 1.36.12-fips-dev
sha256:d08215e417aa2b834375a6e6d2a95ad22795fab0fe2f03d692c315755a322ae9
Manifest digest:sha256:5cbaaa52c30e6097395a1c113711d26d1651684d370577dc9f1886dae37d0cfc
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/envoy:1.36-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/envoy:1.36-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/envoy@sha256:6a182ead5fa8fada4ba202f5d01e2bd1c2955a2eeef46c843ac2347befdf9c7a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/envoy@sha256:da4705911d11050d9274c9ff246915ae8cbb194c9aa81b8f80f81ad37d6f3fd3 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/envoy@sha256:3ad098d463c664c6dcdfaf7d576cc4c9ddcfefc3ec03de6c4fe9c5abc757c2f2 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/envoy@sha256:8815517ea2ce1877f25a9c870781f97167e2c9a3f626528e3cabe6f1b7bf9083 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/envoy@sha256:d091aec3f0002c53cbbb4a870e65a32742ad86e2ea593c0f89a3b2611e5bf721 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/envoy@sha256:9dfb3b1a73ef5d2c442169b6dba55fb6e097ac191f8b66af09ee31845caecb74 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/envoy@sha256:0ef74cd2e7db7a9a88ed52e89a593a9ff9cc735772cc1bd8b75bab7fb2103b04 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/envoy@sha256:166a1585f318bbdac34101c8bda0ba8e14bc42c5d49ac2bf63eaace96be98c54 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/envoy@sha256:191b6750e30237376e925d613c698cda0f9701bdd6bf13cdef0b169e60a168d7 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/envoy@sha256:ca480a1034bc3f1564f6d3c5cac5b95342731b4704d376523c24be50bbd2e409 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/envoy@sha256:37801cfb895420a220dbb4c233658414fd76ea740f96c26b177d340df1d2446f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/envoy@sha256:9edca1717bfc2da091aefc00110acc02d3b67597858fc6e3700a25b7056e06f5 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/envoy@sha256:2490a54e42408b99e206804a09cd0afd4b961eb4b6d3013554ea0c54395d2806 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/envoy@sha256:8f667425145ea8b4bd346398eeb21ae52cae665edc7f92b4fc8715cd523d69cf |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/envoy@sha256:63c51aa75ce2dca7f7c37f86ed439b456f30cf7c07aa76c9a6d104061def2d58 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/envoy@sha256:9053642a1e9bf8cc550a817a37082521beb6a565e7263d6ca776b3b491413325 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/envoy@sha256:9f9dc25935c59135c2a4f7be7e31794d2e01661c43120135ab36e405be1cdbed |