dhi.io/vsphere-csi-syncer
vSphere CSI Syncer 3.3.x (fips)
3.3-debian-fips, 3.3-debian13-fips, 3.3-fips, 3.3.1-debian-fips, 3.3.1-debian13-fips, 3.3.1-fips
sha256:e5e0b9f4ce6bf33d01329b9600685c45aeee64d69ab99d7301e562bd2122a9f4
Manifest digest:sha256:37265f27c877f50dc21881fd33c6fa30e3ee25e1afc4073ad138e865b5d309a0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/vsphere-csi-syncer:3.3-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/vsphere-csi-syncer:3.3-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/vsphere-csi-syncer@sha256:657b05f642308d1142527a214a36f613f61d2ec64bff8424a76f24d824cb0751 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/vsphere-csi-syncer@sha256:730b8322f5b1c28aa5670732f4e38230d0b9bb0ef6b882b60044e73ceef165db |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/vsphere-csi-syncer@sha256:8de47825dc3704919d3e1a3b130ebe55bc9039eb2001de33817f4e90604791b5 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/vsphere-csi-syncer@sha256:332e9a2733d451a706a08382015df74bf1049f646079f622ae7434f2389fcd27 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/vsphere-csi-syncer@sha256:cf4e3eea3838f6e71aa2bbd12c1bbbb23a1d20a14eb6c595e344149a01d65f14 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/vsphere-csi-syncer@sha256:57c1298eddc344fa0fd87628b8615c46b127d1402bd34ba8a32c62dd8d60b175 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/vsphere-csi-syncer@sha256:cadbd65af07ed11d6e29a8706afcec0c29ab6d4b54da0307a55de5351642bbbc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/vsphere-csi-syncer@sha256:53bafe78402351a3e7ae79953039468c9ee27fd507c98f2496f60a1e4239527a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/vsphere-csi-syncer@sha256:20291cc4e5de5f9d3a3971efe1f4c4b477a21ba577b588e908eec6459368dfa9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/vsphere-csi-syncer@sha256:c875fdf39c624f9676da1d72d93ca760aaeeec299074045cafc6485cf99f1ab2 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/vsphere-csi-syncer@sha256:4697cf01e830a6f761fc3547008a1509b93dd6c76ffe5675f95a4ecf9c6c0429 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/vsphere-csi-syncer@sha256:9946207d14013fdd49492928f26d455fe8586d846144bc3652ebd04b82db8ad5 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/vsphere-csi-syncer@sha256:dc7138b3072f921b1f9cd14df9fdab557f76aa24d601bf1708398f987c95f262 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/vsphere-csi-syncer@sha256:4e0d88635236910f7cc12d0519815f8924a2bb246e60757df45e44311b422df5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/vsphere-csi-syncer@sha256:34f6ac695d37370511e54a45e1c0a5341d4d15fbb6ee3848a52147eb7eb3f58b |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/vsphere-csi-syncer@sha256:fc80cdfb05727e7d67bb1af9e67e2bbcb3c13a6f51fd473f0fd4acc317adff4d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/vsphere-csi-syncer@sha256:2ccbf54cc0a4edb45761aab2e0368a0f34a2e220f71553d49d035dbb8ef3e405 |