dhi.io/gitlab-runner-helper
GitLab Runner Helper 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:c9c698c2d3350c55be4592604b1a88bdf4ff8549298462a381238b489b14667b
Manifest digest:sha256:c016aee8b10cd9db084408ef263c0a68673e92c6ab060ff4067d28ee31ce73ec
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:642055a36842bbdf63b9fb49bca404169ef39fafbbbfe12a8e2508573bf9eeed |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:daf982cbf9abf1b2ed32779023f95da39b1f5ed93e12d1e99adbac52e16af00b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:2a58ae9bc870206dd5237fe3978089881d4973809fc003fa292e22ab7cbfeaad |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:021b87510e1b293b83704fc304a8f02c3b581c7b48115995ddd822863d963cfd |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:e8d3cf52854a3ca99a8ceb0382bad087f10ae42a71e0f944a9975445b581c740 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:02db1f3ba48a43ddaf466ca2e870723c7da7a97dccb625411a71db6fedcf6560 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:ae66eb85db872df7a62bc9e6f98244d3ae1fc89bb39294f01adc951b07684a4a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:a0c85d98c37e0430db6c9a7da225218626e39b3863802fcc2cb933818b8e6f0a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:a095664861eb4b3754e7c8fdf693a8a369ea315af2df4d561187c7796586faac |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:4b3fa632806a370f16a1837a8c509388b755806ff14db42e0ea8c11a978e1203 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:2cea43574f53350224758dd8c9a08bf75131992c9407672c5aa64ba6c3f554a0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:6b7f5327f68ae1ba84d1cd2a12d2b3dfbc244b092bb663cb5c145273cf79c0c1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:d471b8e57e1e5c8835ea2d6078d4c90f8375b9a0623dc8a7f62ecdf931775b89 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:49177fa8690eab31d7913f278e86d7830600ac3e888d002c10f6f1cfe240e44e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:ab40808dc69237d51e9bbca15044c21e65078389fb93837803904c2a74386f50 |