dhi.io/nats
NATS 2.15.x (fips)
2-debian-fips, 2-debian13-fips, 2-fips, 2.15-debian-fips, 2.15-debian13-fips, 2.15-fips, 2.15.0-debian-fips, 2.15.0-debian13-fips, 2.15.0-fips
sha256:43a95c8c5e7dea4fd839e59c94f07541d4b31caf1080f6ae740d18b7752a783f
Manifest digest:sha256:ed1fad629abc6a190ea7bf4a08c58a92510f31ad3d077ee63fbb6e49e1c0b172
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/nats:2-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/nats:2-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/nats@sha256:bfa3ae18fb9ac494103f86a5179c3484354a437dc379e91f53b00a5881a6f82d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/nats@sha256:ce46fdbc32b0b5f858f316c6b87fcf58a8b4113ea6fc6266a3c12dcbe6cbaaa7 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/nats@sha256:d587ff477a0a12ef2c7e81d3f4af5f064d055cecdad4d4404b0a3c387cce23ad |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/nats@sha256:e9a79b64a21ec43c58befb126ba77b7860b8375ec81cbdff7bc711589231baee |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/nats@sha256:c4d02fad8c1e91c54130879ab16a5f6d211ff022ef2f33b334a14e6e0d47c58c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/nats@sha256:e803864635f6940151ece884f7c655b1e93fd328aef4b9eebe10ad3722fab427 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/nats@sha256:3ef9cc204619bab6258c98583df7a97b16fc20f744b077f51154f16cffed424a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/nats@sha256:a29aa28a208252238aa52b9bdd197ec7c721a5b7af58f0a257ef0c468ae43816 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/nats@sha256:ef4a78dffae6b841ebbf2393eec334628d88c844fae56b0adbd58df53e020bab |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/nats@sha256:8629cf831a418c8c29788bb2ffcbce4cbeec1396b711759039dab6f7c6767c95 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/nats@sha256:3ce65b780463d1efcb5b6a0f5618b2259e1720fe50f20d21bdfb09b24bf0da65 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/nats@sha256:2108e2ad167379044cf3132055f193561fed09c73016fa2bd8ebd7db1b2efe1b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/nats@sha256:7f49225e20c9047aa875281bfc6f51bc2bd108af07a9047abee89697a5c62733 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/nats@sha256:eef161658781ee8304c0307bc9a2608be14073cbb4641f6f8baa7d2896e0b896 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/nats@sha256:cc0df90b656e53cadff70a2e45ddb4def6c9c81db19a26efbd3976f327454f3c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/nats@sha256:b01650797531f48146bd84980f6cf806c9855ba9291c68dc0be56ce283703a88 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/nats@sha256:79b2e75fd50e17fa5c4a5bf7cbbb027e7f874e066ecbc2c7819ad416a8d9e469 |