dhi.io/sapmachine
SapMachine 26.x JDK (fips, dev)
26-jdk-debian-fips-dev, 26-jdk-debian13-fips-dev, 26-jdk-fips-dev, 26.0-jdk-debian-fips-dev, 26.0-jdk-debian13-fips-dev, 26.0-jdk-fips-dev, 26.0.2-jdk-debian-fips-dev, 26.0.2-jdk-debian13-fips-dev, 26.0.2-jdk-fips-dev
sha256:86153db0515ab17d3054159802528b0fc08b5e3198a4542714f82012a27304ab
Manifest digest:sha256:9338c9fc67b2d0c21973f4ac4584fbdb656e9d4cfc4cb93865d8d3e0a921187a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/sapmachine:26-jdk-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/sapmachine:26-jdk-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/sapmachine@sha256:7d8de44c23005b0a8ad2d1df0eba421477ca5fe35d5b5c90be38101e7e6e49fd |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/sapmachine@sha256:0db148c935f31a5dd4e0bc64caef56992c283e2504aa5772945f94d386e4b982 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/sapmachine@sha256:ae2e247dc85a5c7c33d61f7c4268eaef1cf318844f170aecb4ee4ca95a0627a6 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/sapmachine@sha256:adaa020acba0fd82c7af4be87bd4e70cde8b6edaa3fe88702b92f4bc827e21e9 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/sapmachine@sha256:e0436d93e617c2517ea07c8643e009d61d6d6380607b4fc4231a6fed50581a36 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/sapmachine@sha256:87df746e12031c9402c3e5d7d428bb8c9250a1f203a582a8c02c1dd59e8ce3e7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/sapmachine@sha256:66aa33122e1f4218868bb800957b4070ecf8967e16c191b2355c5bf4554e4c16 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/sapmachine@sha256:f7a10abab64e34baa0df8753197bd33e49fc55ed813b4a3959b4fcb95b54cee1 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/sapmachine@sha256:c32c882115933ebb23516d8ef6875cdca8209764e7ae47f4e27941ae84ccf0fe |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/sapmachine@sha256:ee42e2b724747adbccfa6d5ae1a151c8f9d3df7f3887c71699ddc90be8926be4 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/sapmachine@sha256:f0cbee16cd6546fa7493e9a2088a4610253f79c54c18635cfd6d8f0879b2c181 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/sapmachine@sha256:f97fd5772c7e7da6dfe86314949ac6c7b392a74e75800bca7166fd99c2f5b540 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/sapmachine@sha256:2488c5a8c2778694b3095fd42d3c04407893c4d0973b743707d7a412ff0460af |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/sapmachine@sha256:40e682a863afa8b34c30652ce430d96d3a11798868e688a8adb65b2f901e0db2 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/sapmachine@sha256:52276ec6a8e023161e1df2ed485dc465f51441960fc643368b196b93159ed643 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/sapmachine@sha256:3300fcc4a281ce12fe10e91926db7b501284df154bd96de8db9c5c8f4a2594b7 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/sapmachine@sha256:4b28bbd4325499d54ac0f0c68676792b81e5e833ebfbd1a77adbb3e73304122f |