dhi.io/dotnet
.NET 8.x Runtime (fips)
8-alpine-fips, 8-alpine3.24-fips, 8.0-alpine-fips, 8.0-alpine3.24-fips, 8.0.34-alpine-fips, 8.0.34-alpine3.24-fips
sha256:8de027f9ef4e99942a279b3b64ff02c5c833b55d92274324094a6dcd67872132
Manifest digest:sha256:3a92b7de7f26ea175f4a5824e44f17d2a86459a119eb6208d6c68d4713645bad
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:8-alpine-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:8-alpine-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:42c0e9876b039c2adc49b506dc5c3ea52dc2250f2709445943da4df469d3f109 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:e44fb03bcdd0aed4e753accf564c6476da299dc1d149b65c5c34f2d622e19e16 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/dotnet@sha256:fa45ed1c686c6db43691136911cc3c99371e61a6a1ad8f56ce47ce843a677792 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:5f7db5bb43d954d765b3b0752c37245c7b48cc1bb5903efae24a50dbb3917048 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/dotnet@sha256:88c9746f6ed47c6604918245fa5b6a534c5b4e24346b5776eaf02d0b2f63f41a |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:871f3795e98368ece9a2897f618a6e7aa3a0d140be9670f9c89ea4341701bd0a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:1fbcb79b27b549db5e371473fd96f84fbd102c9b0499cdb85bbfe33e6dddd7b1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:d62cec6a0a6e4b3499faccfac6f2fb41503dcb9f83437af46dca255e14765daa |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:9a1909a0281693ef613e9e6c5edb09259a3544cd069acbaeb1438835241833ef |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:3c66b425380880e8988378d76d81272855ef40f4915d99eebc2068a3722b3632 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:0a4b5ad2ffee12215a6837a4d2f4522092277101fae91a41f107f7bf4e7e8a5d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:da7d45c4eaf6c18ef2cbeb6031fffb17ff9d201b2f25ef8dd29110443d403e4a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:de8c954e8e3b9a41ef947d3c450be6b0f4b1e4e9f649853346315d0b0fd8e677 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:aacca27c619936624f55210546bb53b087cbd02f8771e1ee2445b370c1ef5be0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:29560335d3636f5a0307bec06260a7296d22d40073b5d029ac7683c417f5a42b |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:55c6b6f470d668f112c66e651cd9be0b1950bdee31bbff71e45e530d4052ca80 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:656925bb71a5bf291f5d9d6b815955e5d3880c8e88fef85390b36901ec2098b9 |