dhi.io/aspnetcore
ASP.NET Core 8.x (fips)
8-alpine-fips, 8-alpine3.24-fips, 8.0-alpine-fips, 8.0-alpine3.24-fips, 8.0.34-alpine-fips, 8.0.34-alpine3.24-fips
sha256:341cdcbcb7d9df3b629d6beb030fb620cfacb6d2f77fde3e01c047e41295de5a
Manifest digest:sha256:4e5c4d900232003b0b4166f62360fae67de0a5b9c3ec6b66b9ac61a0cf199ad3
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/aspnetcore:8-alpine-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/aspnetcore:8-alpine-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/aspnetcore@sha256:8eb25260d7ee5820265a93fbdaa3e105394a71ccfe90afb15209667499b4a075 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/aspnetcore@sha256:76d63cdf2cf56ff8063f9aea01b6f2dffe6ad07219cc9b5f580a5e425b4c6c8f |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/aspnetcore@sha256:130876760a14b7a6acd1f44c3c917ef94fab3d1385d36f190a2639be8551dc76 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/aspnetcore@sha256:fe8c29524e3474960b4867bdffeaeba495ce0ad1668963c8b865235e41a0b309 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/aspnetcore@sha256:0239e63ece004a3b480ef5810b2d3e07e93025be65f032c311703ffa6380caab |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/aspnetcore@sha256:08c25e2e3bf6344bfb059c923fee47a766671c2c78998a669ff33441b7f2b40b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/aspnetcore@sha256:473f2bfacbbafa2ae75ae0beb6bf3d562b039809766bbec379d353133d699214 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/aspnetcore@sha256:024d8285b61c4b0083a26511e24f5f7a3906aeff0d1c0861a39cc5ea1bbf2b93 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/aspnetcore@sha256:0904241d210f638698f60481ece868266d6c8b1a34903ab10fd114b472848c2a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/aspnetcore@sha256:57dd3474eac66247c4affcbf5ebba2a2b87283104befb330a87e9bc09346b9f1 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/aspnetcore@sha256:b733cc1cc0cf20013fee38bf4aff52298f1b1b7f502180867d941e0cd4e27236 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/aspnetcore@sha256:7c547848789955c297c984ad16f1a4db0ac8a0bb844c643c729108017cfb3636 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/aspnetcore@sha256:b3a93409b4930099484d941cc88ef045614959ca94a3f52d0d8578a43343557a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/aspnetcore@sha256:e3f62b74c5ecca8c5c914b15b8378f6bb92630da8820e2b8cfde623261c352a0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/aspnetcore@sha256:62301fdc36c97c2da76a23446f515df567a251fb6bae3a78c57c6e39d435e333 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/aspnetcore@sha256:a6fa92f4c26f2bac12bfd48ad76f0603d0445b181afc5d292890d805e04613e2 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/aspnetcore@sha256:5f35e29134d5a77c9f443a3cb23bd1ad45d826e4b1fb19ffd52555f85103a6fe |