dhi.io/istio-pilot
Istio Pilot 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.6-debian-dev, 1.29.6-debian13-dev, 1.29.6-dev
sha256:8a472d6c5723bb6fac7386895061f24cc4323d3b1c3ba3f11798f6ea78d14198
Manifest digest:sha256:9dd91dc82e4ffa0418283438715945dcedb41439615624968608fd38d8dba6b8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/istio-pilot:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/istio-pilot:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/istio-pilot@sha256:ac74d9b25d9134c8fe67c0d49ce6d3e2b6ec3651620b7bdc433f083b57bfcdfb |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/istio-pilot@sha256:065fc6c10c1747cd30c3cb0acb876824a04ade46507bce2ab2e156058f0c1fef |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/istio-pilot@sha256:d6661e07b194c8b642300cdd6f09403d3085cded13c214d1babe32444bd22524 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/istio-pilot@sha256:d22fb1d9b0ba183765588aa76cd191426433be8815d9d06ccab7e39ccda284c3 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/istio-pilot@sha256:2136950e21bf111dc317f1ddfc6a8d7719067622e6464ecc4983fc05956f516f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/istio-pilot@sha256:b49a7148dadf4a6c2681036a68a69adceba51e36d329a799885b0eda48cc5193 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/istio-pilot@sha256:04900a5310c135002ffcc961657ab63fc52952ea38ec5148844404db62465450 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/istio-pilot@sha256:b9ce19ccd148c928cf2cd33b1ad4fde1971743b6695fa1ea41a6f2bdbc19ffd9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/istio-pilot@sha256:c0662f85c372cb97fa296b81edcfdb029a87aa3b14d8e484063beb6af352dce8 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/istio-pilot@sha256:236a10b5ea0399a06c7d70c9d55c92ee4a8ac8bc31f1bfb88c4e381e4ac3da3f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/istio-pilot@sha256:f5eb69549d24a66d7889a227d88f88a8d009cd09686c5fd7398367656934d370 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/istio-pilot@sha256:c384762eefb0d8c302015ee9e3afbc50d12f9fa7c628291be490c9882fe1cbf0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/istio-pilot@sha256:0433d48596966b3aadecdf8b28442faaabea827ca4323860465d9ea1e93c6265 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/istio-pilot@sha256:c276f3aecdba7a7e0c32742f50c1be7c3c2b2a48dfcf58c67045d873cc0d37bd |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/istio-pilot@sha256:cc273c6d99b8f469f565536e9b560872043cdc52ce4348ae3d0e7d981c2a6dfc |