dhi.io/gitlab-runner-helper
GitLab Runner Helper 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:8994565f4460dd7839c2b3a15cf81a657f4bf2d6629fd3a95c46659e8454b57e
Manifest digest:sha256:ca230194dade332a1af6cbc85d45386ca6ccced5073187364debfe5324e1d409
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:6cbe88d5484cbef21698ba11780607a19adff1e5bf11cbc837d6dd6724e4803a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:1674a5ae15f9b35f79326dd7984401d74d326cff30a90b15ee034f74932a24d3 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner-helper@sha256:7f6b50ca953b50f77372cac5cee63710c5ad0fd86ec08041586cca1b04d71266 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:8fdf5a9509d7655d70861b5d8deb1544330b57b1564d18709cb9d4f7f54c42fb |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner-helper@sha256:e9d8b0e8186536da03d82aa53b430d12041c5251415b2a9ec5fa5cabc2716473 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:b000dbadc9cc3d03e7466d73d0be7ece5dce326cb0f5071da162cb60e8b9f68a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:7a316ef4073d87d4fd20c1ccdfd18df580ac604e9f15df43a96d7c52a5c656ed |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:a33907c8d1fe9d6f71b637679999aacb1d8502bb48b696a4b948a76c238b1648 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:05c579f63b37326788df2dd3426f348c195b9f5ffac81f502629acc444e902b9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:d0ecbd525922803a82ba7d48e9e7408904b2a3833e010c6986754c4996689865 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:77d87d2866c73a964cdc0984c8ae15746a4bfde908b1089c02c4632f676cc2f4 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:4f26826ba40953f236242d82015424144e3a1921c2edc974783bfa14af0912aa |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:fa277c7db21a26c21a25233e17d6665a5adb9b45113ed4b1dd404207b051ff1b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:c6fcdb22d4a0b88bc3049354c8c43b7d389782c9620d6c96f9ddafabcb01f98e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:a245c79397c992067ad4df81a94a336a6ac4cb03c1fd725056f74d9c255dc2df |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:35211a254fbae693aacadacb48367ecddc2ebff951deea2cc130b2a4d2f74a69 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:9640c077885bdf9beb3988d0470da713d483386c9483543d87e0de0aa19ec899 |