dhi.io/gitlab-runner-helper
GitLab Runner Helper 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:c9c698c2d3350c55be4592604b1a88bdf4ff8549298462a381238b489b14667b
Manifest digest:sha256:c016aee8b10cd9db084408ef263c0a68673e92c6ab060ff4067d28ee31ce73ec
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:642055a36842bbdf63b9fb49bca404169ef39fafbbbfe12a8e2508573bf9eeed |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:f151f9e6857b817dccffca577555ebabe762f2231eba0064df877332812b9db9 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:53ac4286b46d4f7fe2da47db672234144ecd4abb12e8d9394970984d1251a7d3 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:89be704cae8425d8ecb2e636087fa282307bcaadb9fc592aba1210ca4f567888 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:ac789f87bd6e0868ecd78ccaeb438907ebc95fa71a0e5ab285d505cc08d26469 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:02db1f3ba48a43ddaf466ca2e870723c7da7a97dccb625411a71db6fedcf6560 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:ae66eb85db872df7a62bc9e6f98244d3ae1fc89bb39294f01adc951b07684a4a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:a0c85d98c37e0430db6c9a7da225218626e39b3863802fcc2cb933818b8e6f0a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:b9ecfab7c4bb2c453e10786b6bba836c8ec079ed73a795fd513c83a12716cb0a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:45f5a31e435718ab88d45de90c6f4baf9022baabefe35302c7dcb975196ab4db |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:906ac15bb225c8e0d101c7302090dedbb4494950ea4f1752af4defa201023fe0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:6b7f5327f68ae1ba84d1cd2a12d2b3dfbc244b092bb663cb5c145273cf79c0c1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:d471b8e57e1e5c8835ea2d6078d4c90f8375b9a0623dc8a7f62ecdf931775b89 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:49177fa8690eab31d7913f278e86d7830600ac3e888d002c10f6f1cfe240e44e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:ab40808dc69237d51e9bbca15044c21e65078389fb93837803904c2a74386f50 |