dhi.io/vsphere-csi-driver
vSphere CSI Driver 3.3.x (fips)
3.3-debian-fips, 3.3-debian13-fips, 3.3-fips, 3.3.1-debian-fips, 3.3.1-debian13-fips, 3.3.1-fips
sha256:a8f609fcce471300d5264e932ecd65ba4b3f046a344aca29102166f21f39f5e9
Manifest digest:sha256:780b04ad5415ab3436559be3cbe6519cbd8f681b4c2d3a5af1bb11d2576968bc
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/vsphere-csi-driver:3.3-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/vsphere-csi-driver:3.3-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/vsphere-csi-driver@sha256:f5db61d343b782305990d5135353d143891e1c9063360bcc7bce1db4bc588f66 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/vsphere-csi-driver@sha256:13978b595d15eadf3b0a052b07edcc7c278b3142082f9eb1d03091ec5af85ae1 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/vsphere-csi-driver@sha256:e8b5832cb82105ab3384f53ef1b808d4d42b829e64fe6f289b9a6fce0e58a6eb |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/vsphere-csi-driver@sha256:424586d21fcf843f94763cc69b468d4a4403fb0db748e7347420675128ed50d1 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/vsphere-csi-driver@sha256:1babd2a97608a677645ea753fce6dac4bf6c1c77f981a02afc9928bf69f4ec68 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/vsphere-csi-driver@sha256:f946f950a0bd94edfc6759011f64478e533b451eecd11b2c93273fd6de5bd11c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/vsphere-csi-driver@sha256:bb7b3bcca7751e73d78b943d8d3e7ca5551a5c73eb06045d3ed200ccaf8a3344 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/vsphere-csi-driver@sha256:ca661ecfae3b5d3ccd6448023e73054b772293b7ecad4452cbbb7ab9256ee0f6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/vsphere-csi-driver@sha256:baccae731b1880c542ecf60516fd6376ff70506ff1b825e28b9e43aa37464171 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/vsphere-csi-driver@sha256:eb759c2acdf6bac949084243c978ee2782ed83c24002cc66e6a5ed478d70eaaa |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/vsphere-csi-driver@sha256:32cb3bdf83e6606f0984b2b08299b27bbc6a1d98226c5cc73f9de8be3aed8295 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/vsphere-csi-driver@sha256:f24fcc6e1addd47f625835167ec635426dbcbd952caaaf655986e1b4d1ea17fc |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/vsphere-csi-driver@sha256:d7f7ebd52a9b2b14336b61a92a0941902bf4e9a5cbdb9576de0adf2c1af2aac3 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/vsphere-csi-driver@sha256:196a7ae9a5bae8ec2cbf3b5bd549f3f5eed443295f2ff764ee7c9d64319afeef |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/vsphere-csi-driver@sha256:3f2f3caf6abec3bd302991f95696e43adc528449dba06297eb072fdd134050d4 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/vsphere-csi-driver@sha256:b4cdce1a96e6f28621080d870d26ed0c3f7753037952504b7e411b471ba34245 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/vsphere-csi-driver@sha256:020cfa9a5a7f06bc161074e9bb5286b7f78a36224450ea105166b0de61b167bd |