dhi.io/vsphere-csi-driver
vSphere CSI Driver 3.3.x (fips, dev)
3.3-debian-fips-dev, 3.3-debian13-fips-dev, 3.3-fips-dev, 3.3.1-debian-fips-dev, 3.3.1-debian13-fips-dev, 3.3.1-fips-dev
sha256:1111c468eb12c61a4c78bc893879e0d4f29fbc7840409b7b26d9737b468379ae
Manifest digest:sha256:9ea0470f37c3d4cc80b57b4b57322497b697f72d67b67b174544366a64d145b5
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/vsphere-csi-driver:3.3-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/vsphere-csi-driver:3.3-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/vsphere-csi-driver@sha256:99674bc18a01d2d71f5f501def434a24de48b80788759cea01bf026d08b8b81a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/vsphere-csi-driver@sha256:2d6f474bac857ba0bc273238ac8e5cef156474865ec13cbf967b2de4acf04257 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/vsphere-csi-driver@sha256:c0fad048a5e40bbd475011c5fd6f92b3c754a7b6c803ca3ab32f3ae3780e4930 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/vsphere-csi-driver@sha256:c631efa16cd0f42ed4be170c21eee9e482e3a67e0c69220af522ac24a15187be |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/vsphere-csi-driver@sha256:2b85104cff1e5906a3d72f2e3abd064bc539507be44574260c8e32c8a9ddbfab |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/vsphere-csi-driver@sha256:36a9ce5e7cfb89a271216bfb4e5e3eadab26391975a27b59c8e9a96fbbc2eb1b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/vsphere-csi-driver@sha256:2e018fde97e8ea68c6f60b1c36c03bd44ac42ea9ba4198e623335bd6c993baa3 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/vsphere-csi-driver@sha256:f1cbfaa018c75c71df06c1772aeff43784fe3801bda1059115b38d83288e864a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/vsphere-csi-driver@sha256:47368e8b95078b72c6dfe6d235aa5f575d997bc7a25babcdc0d1a65486212006 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/vsphere-csi-driver@sha256:82bcd9f56dd3ff3f093358222993518b9fb48cab9c1aa210d1d8c03d532017f7 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/vsphere-csi-driver@sha256:80bee960934296ee25e963adc50c35ba61b713e40f349d3a90fd6db359eb9708 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/vsphere-csi-driver@sha256:896baae7e1d86602e9c53ecc3ad9b5c6d84d929d47a8907cda7d0ab6179f9fe7 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/vsphere-csi-driver@sha256:162bb650235622b02f6278b9d934ec16412b3de4d9c604f183a9a5a2d36ed3ec |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/vsphere-csi-driver@sha256:d0ce2c92808d9c7676f70bcd6e900226fa80fd9ff65f0a7992a31e48886c7cb2 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/vsphere-csi-driver@sha256:1288d84bdbfce4ad6adf34074d5a6ea57db104f1706aedd919a2e7f3dcb412d0 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/vsphere-csi-driver@sha256:f0e0e172a1507c0fb44c2f6c17b629f6f860f81ced686c4a0ab44697bebdc3a6 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/vsphere-csi-driver@sha256:ba2ee67c81f4befa098ac3c26bbcfe9fb2a7976b8c6dcae8d4b6333996699bf7 |