dhi.io/gitlab-runner-helper
GitLab Runner Helper 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:8aaa5259943f9399eb023c4f734b9620eae0ed48f56fc1c5f9b5eb857d5ddcc9
Manifest digest:sha256:6a2d7cfc5720de257b560e3c960b8a678a9452fa5dc48751b8fa6a7f222475c0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:15efb69b95bef48cc68fe0e4e4189050443e0805015325b0cad8b9d505a25949 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:366c5e5bf9b7631df15cafd9dae1cf5b62b396f4d840cc5a49d57196028a3738 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:3a46913b21c6392d7137d58eba0ac18e436014ef1d30744279042f1b5616ca4c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:f2264eef522414a8c21b8123dbe03d3e8a2748539c4f18e144ff6a076871ec07 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:8099fd10dca107149eab27fc54a4803a769f98b2f4e5e42c85e6e2c84454533a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:02abdfa7ee49403bfe5f3e051eba381c7e3e518e11fb572d0bec0f1d27b8f149 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:717a677f0d0076faf9fd30b21b723cc3891521b6e43e7facc4f3866213a73e8f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:347e5b3d483458575a0962f811cc9ae0945af9035ba4587765a6b1fb1ca7d328 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:6f0c226e3459ae69ecdcaa34215bdde56806a1101c4228576c222abdb9596592 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:5b18415ae61a2d7e923acfceab6a867faeb6bd94a330c0f10ff7e581c7cf1a09 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:11a64ab62d451408be4c50a82d3c128583105ad441cb6ee21e56c837b07620b6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:a0ed505e43f7f2e092b00f9925434acf2d32f3a2ec0858e863bc4506fa58231d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:b73f02a0b34eb6f2be2c9a342c4f2671a10d2453534bc601032cd261b54b8875 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:ac67c08624552e3eed142119739ad7deb6678101ef61fcf293d1b5374b117d2f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:1db0cb43b05d330e26919a22dfdc63d69deca39ff6bc503b6529d189db199f0f |