Skip to content

Commit a013337

Browse files
craig-osterhoutcraig-osterhout
committed
dhi: add helm attestations
Signed-off-by: Craig Osterhout <[email protected]>
1 parent 2f6af4a commit a013337

File tree

3 files changed

+106
-39
lines changed

3 files changed

+106
-39
lines changed

‎content/manuals/dhi/core-concepts/attestations.md‎

Lines changed: 43 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,21 @@ description: Review the full set of signed attestations included with each Docke
44
keywords: container image attestations, signed sbom, build provenance, slsa compliance, vex document
55
---
66

7-
Docker Hardened Images (DHIs) include comprehensive, signed security
8-
attestations that verify the image's build process, contents, and security
9-
posture. These attestations are a core part of secure software supply chain
10-
practices and help users validate that an image is trustworthy and
11-
policy-compliant.
7+
Docker Hardened Images (DHIs) and charts include comprehensive, signed security
8+
attestations that verify the build process, contents, and security posture.
9+
These attestations are a core part of secure software supply chain practices and
10+
help users validate that images and charts are trustworthy and policy-compliant.
1211

1312
## What is an attestation?
1413

15-
An attestation is a signed statement that provides verifiable information
16-
about an image, such as how it was built, what's inside it, and what security
14+
An attestation is a signed statement that provides verifiable information about
15+
an image or chart, such as how it was built, what's inside it, and what security
1716
checks it has passed. Attestations are typically signed using Sigstore tooling
1817
(such as Cosign), making them tamper-evident and cryptographically verifiable.
1918

2019
Attestations follow standardized formats (like [in-toto](https://in-toto.io/),
2120
[CycloneDX](https://cyclonedx.org/), and [SLSA](https://slsa.dev/)) and are
22-
attached to the image as OCI-compliant metadata. They can be generated
21+
attached to the image or chart as OCI-compliant metadata. They can be generated
2322
automatically during image builds or added manually to document extra tests,
2423
scan results, or custom provenance.
2524

@@ -38,25 +37,26 @@ They are essential for meeting industry standards such as SLSA,
3837
and help teams reduce the risk of supply chain attacks by making build and
3938
security data transparent and verifiable.
4039

41-
## How Docker Hardened Images use attestations
40+
## How Docker Hardened Images and charts use attestations
4241

43-
All DHIs are built using [SLSA Build Level
42+
All DHIs and DHI charts are built using [SLSA Build Level
4443
3](https://slsa.dev/spec/latest/levels) practices, and each image variant is
4544
published with a full set of signed attestations. These attestations allow users
4645
to:
4746

48-
- Verify that the image was built from trusted sources in a secure environment
47+
- Verify that the image or chart was built from trusted sources in a secure
48+
environment
4949
- View SBOMs in multiple formats to understand component-level details
5050
- Review scan results to check for vulnerabilities or embedded secrets
51-
- Confirm the build and deployment history of each image
51+
- Confirm the build and deployment history of each image or chart
5252

5353
Attestations are automatically published and associated with each mirrored DHI
54-
in your Docker Hub organization. They can be inspected using tools like [Docker
55-
Scout](../how-to/verify.md) or
54+
and chart in your Docker Hub organization. They can be inspected using tools
55+
like [Docker Scout](../how-to/verify.md) or
5656
[Cosign](https://docs.sigstore.dev/cosign/overview), and are consumable by CI/CD
5757
tooling or security platforms.
5858

59-
## Available attestations
59+
## Image attestations
6060

6161
While every DHI variant includes a set of attestations, the attestations may
6262
vary based on the image variant. For example, some images may include a STIG
@@ -83,10 +83,35 @@ details](../how-to/explore.md#view-image-variant-details) in Docker Hub.
8383
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. | `https://spdx.dev/Document` |
8484
| FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. | `https://docker.com/dhi/fips/v0.1` |
8585

86-
## View and verify attestations
86+
To view and verify attestations for an image, see [Verify image
87+
attestations](../how-to/verify.md#verify-image-attestations-with-docker-scout).
8788

88-
To view and verify attestations for an image, see [Verify a Docker Hardened
89-
Image](../how-to/verify.md).
89+
## Helm chart attestations
90+
91+
Docker Hardened Image (DHI) charts also include comprehensive signed attestations
92+
that provide transparency and verification for your Kubernetes deployments. Like
93+
DHI container images, these charts are built following SLSA Build Level 3
94+
practices and include extensive security metadata.
95+
96+
DHI Helm charts include the following attestations:
97+
98+
| Attestation type | Description | Predicate type URI |
99+
|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------|
100+
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing the chart itself and all container images and tools referenced by the chart. | `https://cyclonedx.org/bom/v1.6` |
101+
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the container images and components referenced by the chart. | `https://in-toto.io/attestation/vulns/v0.1` |
102+
| Scout health score | A signed attestation from Docker Scout that summarizes the overall security and quality posture of the chart and its referenced images. | `https://scout.docker.com/health/v0.1` |
103+
| Scout provenance | Provenance metadata generated by Docker Scout, including the chart source repository, build images used, and build parameters. | `https://scout.docker.com/provenance/v0.1` |
104+
| Scout SBOM | An SBOM generated and signed by Docker Scout, including the chart and container images it references, with additional Docker-specific metadata. | `https://scout.docker.com/sbom/v0.1` |
105+
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys, in the chart package. | `https://scout.docker.com/secrets/v0.1` |
106+
| Tests | A record of automated tests run against the chart to validate functionality and compatibility with referenced images. | `https://scout.docker.com/tests/v0.1` |
107+
| Virus scan | Results of antivirus scans performed on the chart package. | `https://scout.docker.com/virus/v0.1` |
108+
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data for the chart's referenced images. | `https://scout.docker.com/vulnerabilities/v0.1` |
109+
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the chart was built, including build tool, source repository, referenced images, and build materials. | `https://slsa.dev/provenance/v0.2` |
110+
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, listing the chart and all container images and tools it references. | `https://spdx.dev/Document` |
111+
112+
For instructions on how to view and verify Helm chart attestations, see [Verify
113+
Helm chart
114+
attestations](../how-to/verify.md#verify-helm-chart-attestations-with-docker-scout).
90115

91116
## Add your own attestations
92117

‎content/manuals/dhi/features/helm.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Like the hardened images, DHI charts incorporate multiple layers of security met
2121
authenticity.
2222
- Hardened configuration: Charts automatically reference Docker hardened images, ensuring security in deployments.
2323

24+
For a complete list of attestations included with DHI charts and how to view them, see [Helm chart
25+
attestations](../core-concepts/attestations.md#helm-chart-attestations).
26+
2427
## Developer Friendly
2528

2629
DHI charts are robustly tested after building to ensure they work out-of-the-box with Docker Hardened Images. This

‎content/manuals/dhi/how-to/verify.md‎

Lines changed: 60 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,44 @@
11
---
2-
title: Verify a Docker Hardened Image
3-
linktitle: Verify an image
4-
description: Use Docker Scout or cosign to verify signed attestations like SBOMs, provenance, and vulnerability data for Docker Hardened Images.
2+
title: Verify Docker Hardened Images and charts
3+
linktitle: Verify images and charts
4+
description: Use Docker Scout or cosign to verify signed attestations like SBOMs, provenance, and vulnerability data for Docker Hardened Images and Helm charts.
55
weight: 40
6-
keywords: verify container image, docker scout attest, cosign verify, sbom validation, signed container attestations
6+
keywords: verify container image, docker scout attest, cosign verify, sbom validation, signed container attestations, helm chart verification
77
---
88

99
{{< summary-bar feature_name="Docker Hardened Images" >}}
1010

11-
Docker Hardened Images (DHI) include signed attestations that verify the image’s
11+
Docker Hardened Images (DHI) and DHI Helm charts include signed attestations that verify the
1212
build process, contents, and security posture. These attestations are available
13-
for each image variant and can be verified using
13+
for each image variant and chart, and can be verified using
1414
[cosign](https://docs.sigstore.dev/) or the Docker Scout CLI.
1515

16-
Docker's public key for DHI images is published at:
16+
Docker's public key for DHI images and charts is published at:
1717

1818
- https://registry.scout.docker.com/keyring/dhi/latest.pub
1919
- https://github.com/docker-hardened-images/keyring
2020

21-
## Verify attestations with Docker Scout
21+
## Available DHI attestations
22+
23+
See [available image attestations](../core-concepts/attestations.md#image-attestations) for a list
24+
of attestations available for each DHI, and [available Helm chart attestations](../core-concepts/attestations.md#helm-chart-attestations)
25+
for attestations included with DHI charts.
26+
27+
### Explore image attestations on Docker Hub
28+
29+
You can also browse attestations visually when [exploring an image
30+
variant](./explore.md#view-image-variant-details). The **Attestations** section
31+
lists each available attestation with its:
32+
33+
- Type (e.g. SBOM, VEX)
34+
- Predicate type URI
35+
- Digest reference for use with `cosign`
36+
37+
These attestations are generated and signed automatically as part of the Docker
38+
Hardened Image build process.
39+
40+
41+
## Verify image attestations with Docker Scout
2242

2343
You can use the [Docker Scout](/scout/) CLI to list and retrieve attestations for Docker
2444
Hardened Images, including images mirrored into your organization's namespace.
@@ -231,21 +251,40 @@ Example output:
231251
> --key https://registry.scout.docker.com/keyring/dhi/latest.pub --experimental-oci11
232252
> ```
233253
234-
## Available DHI attestations
254+
## Verify Helm chart attestations with Docker Scout
235255
236-
See [available
237-
attestations](../core-concepts/attestations.md#available-attestations) for list
238-
of attestations available for each DHI.
256+
You can use the Docker Scout CLI to list and retrieve attestations for DHI Helm
257+
charts using the same commands as for images.
239258
240-
## Explore attestations on Docker Hub
259+
### List available chart attestations
241260
242-
You can also browse attestations visually when [exploring an image
243-
variant](./explore.md#view-image-variant-details). The **Attestations** section
244-
lists each available attestation with its:
261+
To list all attestations attached to a DHI Helm chart:
245262
246-
- Type (e.g. SBOM, VEX)
247-
- Predicate type URI
248-
- Digest reference for use with `cosign`
263+
```console
264+
$ docker scout attestation list <your-namespace>/<chart-name>:<tag>
265+
```
249266
250-
These attestations are generated and signed automatically as part of the Docker
251-
Hardened Image build process.
267+
For example, to view attestations for the Redis HA chart for the `docs` organization:
268+
269+
```console
270+
$ docker scout attestation list docs/dhi-redis-ha-chart:4.35.2
271+
```
272+
273+
This command displays an overview of the chart including its provenance source
274+
and a detailed list of all available attestations with their predicate types and
275+
digest information.
276+
277+
### Retrieve a specific chart attestation
278+
279+
To retrieve the full content of a specific attestation, use:
280+
281+
```console
282+
$ docker scout attestation get <your-namespace>/<chart-name>:<tag> --predicate-type <predicate-uri>
283+
```
284+
285+
For example, to view the SLSA provenance:
286+
287+
```console
288+
$ docker scout attestation get docs/dhi-redis-ha-chart:4.35.2 \
289+
--predicate-type https://slsa.dev/provenance/v0.2
290+
```

0 commit comments

Comments
 (0)