dhi.io/gitlab-runner-helper
GitLab Runner Helper 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:a127dd434d7d6e5dcb311ff06b67310fd6598ef9d4480d396bf30c4a9b3c186c
Manifest digest:sha256:bd33082e98091f4bda60a54e6ed6bb4d7744c890a6393074e6f9a9225a866b39
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:3d2a1998cdcd5a5139cd62aa8cc288fb363e5f2216594193950e43e178f8d519 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:87f228b78fea69747624512a033a6c594e50c32c82827c192a0167a0f3b091e9 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:f6c1a351b6d5e96e6368555c7a7d48dc31fbea149d1abb13ac68011c64c9a274 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:d4a594c48dda0a998801e7aa97c28d31e2197df8499af0a5ddb8c84a8aa07722 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:8514df201e287f417fbafc286aabc27e340825a0026f923c0327758c095ea8a0 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:b6b52e7776fcf9daa7ef709c538110302ab1320c053c09f870d82fac887e7d4f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:468f0257e027d91fd134fae48fa7eb8869acae8381391f649ac9d5097ab7b3a8 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:cc74aaa34aee9622c07e07ebe44f08fa730026ebd15cec38594a86a952d725a2 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:ace1f678122b791a402b390032d4ca5e5f7bb07d55644a37fb400d2d6e171063 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:a3ca86f7f826cecf9ce5e9565a9966dee6ec243baa0eb9cf4c243eeb8c580189 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:b19057c1630b92f47128823a1fc49ee47343e8c7b9aedff019027d89bad671c9 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:f2e0d1fb98bafb9484f76df003f30070eecc1e342a4bab5b1a2fe914e4982d1d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:236be4fdabe844673c81d336a521bd71043bb79ebd54e4a8083206814a6bf21a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:47c077fd0240551bbe13792a8b0b8370f75d9853fda7b5ad50d3953207fa9783 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:c29c3c4cf28c5472a6a727771f4e2c9966d61b33df9a6e986605fc572ae86c60 |