Tigera Operator 1.40.x (fips)

Overview

Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.⁠

Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub⁠ and also archived at https://github.com/docker-hardened-images/keyring⁠.

How to verify attestations

docker scout attest list dhi.io/tigera-operator:1.40-debian-fips

docker scout attest get dhi.io/tigera-operator:1.40-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verify