dhi.io/aspnetcore
ASP.NET Core 9.x (fips, dev)
9-debian-fips-dev, 9-debian13-fips-dev, 9-fips-dev, 9.0-debian-fips-dev, 9.0-debian13-fips-dev, 9.0-fips-dev, 9.0.22-debian-fips-dev, 9.0.22-debian13-fips-dev, 9.0.22-fips-dev
sha256:f251d88bd63a87827768cb848d9676f625193a08d64a9ab6dc1bb7925cf60e8e
Manifest digest:sha256:3a98c61facaa1e04d61d4a8e588aa2749c40c8ffdf784fe162ebd38c4b2ca4c6
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/aspnetcore:9-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/aspnetcore:9-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/aspnetcore@sha256:91df35ec9211313daf0fde6ac82eab60cb5afee09e533e9a430e6e1919d71934 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/aspnetcore@sha256:12bc3705bf1e79f65089c1606d90f92c711239c335bb154a2782587ea18a934c |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/aspnetcore@sha256:71490e5b77c8efcb88ac3d1c1478c61967b08515eea5669c2df61e3dcec156cf |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/aspnetcore@sha256:862cfc7fc0f330dd3999d0842e15a60237c59b1576e15fe9b31a7c7a75277e5a |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/aspnetcore@sha256:dce7aacffa2dcc982ba7b5bef68040e698b60b0019d6d5d2c6f2592288c7815d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/aspnetcore@sha256:7f8fdd327c15075b80dc0d5dd6bc9286d9d175c900c38cb9425e5e8e4f03516f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/aspnetcore@sha256:1db7fd37a672896e0211406d13e3b0966fbd7aefc210e1ebacf3ef8b10bd7892 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/aspnetcore@sha256:e34b2e9bf4e29b0daad37d7b32587c6bbfa7b851612ba3d7ea85ac038631db1c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/aspnetcore@sha256:65aa788daae4fe5849e84da784a344273babafadf5d57560fd5847ac06943fbc |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/aspnetcore@sha256:289ab0d9c68521009fe2ec82ae1771c17fab5da0869ea2dc28eb87f3386471a6 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/aspnetcore@sha256:28a69bc01d81246368f30c684d7d7cadf6061b6d1c1638e0fd5d1bc245fcc921 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/aspnetcore@sha256:26fdf747019937ec6a422f709d5839c24b4e771304bcf800a720df42efb564ac |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/aspnetcore@sha256:25e7c5e9429929dd699a47affdf1fe23ed3d4a4dcfd4d4e9aae1896ce5968535 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/aspnetcore@sha256:2ace0f49cb7d4af3a260b8f79e1bfd650dd84ad95495b1af86ad43db082a8080 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/aspnetcore@sha256:e979e2a1a9ebf4a5c669062d0dad7bb55e406e2092820d9992335fb1a046985e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/aspnetcore@sha256:70ab59d5084cafba0f9bb8a0f88a70cb82aee36e79de700c39beb61c30278ccd |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/aspnetcore@sha256:d16da3e0c8800f377d5da570bcc9bfda700b07cc0494085c61634a2112eea888 |