Skip to content

Commit 726b389

Browse files
dvdksnclaude
dvdksn
and
claude
committed
docs: lead with concept on DHI attestations page
Rewrite the opening paragraph to define attestations in general terms before framing them in a DHI-specific context, consistent with other pages under core-concepts/. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1 parent bff6fe0 commit 726b389

File tree

1 file changed

+40
-40
lines changed

1 file changed

+40
-40
lines changed

‎content/manuals/dhi/core-concepts/attestations.md‎

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ description: Review the full set of signed attestations included with each Docke
44
keywords: container image attestations, signed sbom, build provenance, slsa compliance, vex document
55
---
66

7-
Docker Hardened Images (DHIs) and charts include comprehensive, signed security
8-
attestations that verify the image's build process, contents, and security
9-
posture. These attestations are a core part of secure software supply chain
10-
practices and help users validate that an image is trustworthy and
7+
Attestations are signed statements about an image or chart — verifiable
8+
metadata that describes how it was built, what it contains, and what security
9+
checks it has passed. Attestations are a core part of secure software supply
10+
chain practices, and help you validate that an image is trustworthy and
1111
policy-compliant.
1212

1313
## What is an attestation?
@@ -27,9 +27,9 @@ scan results, or custom provenance.
2727

2828
Attestations provide critical visibility into the software supply chain by:
2929

30-
- Documenting *what* went into an image (e.g., SBOMs)
31-
- Verifying *how* it was built (e.g., build provenance)
32-
- Capturing *what security scans* it has passed or failed (e.g., CVE reports,
30+
- Documenting _what_ went into an image (e.g., SBOMs)
31+
- Verifying _how_ it was built (e.g., build provenance)
32+
- Capturing _what security scans_ it has passed or failed (e.g., CVE reports,
3333
secrets scans, test results)
3434
- Helping organizations enforce compliance and security policies
3535
- Supporting runtime trust decisions and CI/CD policy gates
@@ -50,7 +50,7 @@ to:
5050
- Review scan results to check for vulnerabilities or embedded secrets
5151
- Confirm the build and deployment history of each image
5252

53-
Attestations are automatically published and associated with each DHI
53+
Attestations are automatically published and associated with each DHI
5454
and chart. They can be inspected using tools like [Docker
5555
Scout](../how-to/verify.md) or
5656
[Cosign](https://docs.sigstore.dev/cosign/overview), and are consumable by CI/CD
@@ -71,24 +71,24 @@ $ docker scout attest list dhi.io/<image>:<tag>
7171

7272
For more details, see [Verify image attestations](../how-to/verify.md#verify-image-attestations).
7373

74-
| Attestation type | Description |
75-
|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
76-
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing components, libraries, and versions. |
77-
| STIG scan | Results of a STIG scan, with output in HTML and XCCDF formats. |
78-
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the image's components, based on package and distribution scanning. |
79-
| VEX | A [Vulnerability Exploitability eXchange (VEX)](https://openvex.dev/) document that identifies vulnerabilities that do not apply to the image and explains why (e.g., not reachable or not present). |
80-
| Scout health score | A signed attestation from Docker Scout that summarizes the overall security and quality posture of the image. |
81-
| Scout provenance | Provenance metadata generated by Docker Scout, including the source Git commit, build parameters, and environment details. |
82-
| Scout SBOM | An SBOM generated and signed by Docker Scout, including additional Docker-specific metadata. |
83-
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys. |
84-
| Tests | A record of automated tests run against the image, such as functional checks or validation scripts. |
85-
| Virus scan | Results of antivirus scans performed on the image layers. For details, see [Malware scanning](../explore/malware-scanning.md). |
86-
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data. |
87-
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the image was built, including build tool, parameters, and source. |
88-
| SLSA verification summary | A summary attestation indicating the image's compliance with SLSA requirements. |
89-
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. |
90-
| FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. |
91-
| DHI Image Sources | Links to a corresponding source image containing all materials used to build the image, including package source code, Git repositories, and local files, ensuring compliance with open source license requirements. |
74+
| Attestation type | Description |
75+
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
76+
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing components, libraries, and versions. |
77+
| STIG scan | Results of a STIG scan, with output in HTML and XCCDF formats. |
78+
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the image's components, based on package and distribution scanning. |
79+
| VEX | A [Vulnerability Exploitability eXchange (VEX)](https://openvex.dev/) document that identifies vulnerabilities that do not apply to the image and explains why (e.g., not reachable or not present). |
80+
| Scout health score | A signed attestation from Docker Scout that summarizes the overall security and quality posture of the image. |
81+
| Scout provenance | Provenance metadata generated by Docker Scout, including the source Git commit, build parameters, and environment details. |
82+
| Scout SBOM | An SBOM generated and signed by Docker Scout, including additional Docker-specific metadata. |
83+
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys. |
84+
| Tests | A record of automated tests run against the image, such as functional checks or validation scripts. |
85+
| Virus scan | Results of antivirus scans performed on the image layers. For details, see [Malware scanning](../explore/malware-scanning.md). |
86+
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data. |
87+
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the image was built, including build tool, parameters, and source. |
88+
| SLSA verification summary | A summary attestation indicating the image's compliance with SLSA requirements. |
89+
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. |
90+
| FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. |
91+
| DHI Image Sources | Links to a corresponding source image containing all materials used to build the image, including package source code, Git repositories, and local files, ensuring compliance with open source license requirements. |
9292

9393
## Package attestations
9494

@@ -121,19 +121,19 @@ $ docker scout attest list dhi.io/<chart>:<version>
121121

122122
For more details, see [Verify Helm chart attestations](../how-to/verify.md#verify-helm-chart-attestations-with-docker-scout).
123123

124-
| Attestation type | Description |
125-
|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
126-
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing the chart itself and all container images and tools referenced by the chart. |
127-
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the container images and components referenced by the chart. |
128-
| Scout health score | A signed attestation from Docker Scout that summarizes the overall security and quality posture of the chart and its referenced images. |
129-
| Scout provenance | Provenance metadata generated by Docker Scout, including the chart source repository, build images used, and build parameters. |
130-
| Scout SBOM | An SBOM generated and signed by Docker Scout, including the chart and container images it references, with additional Docker-specific metadata. |
131-
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys, in the chart package. |
132-
| Tests | A record of automated tests run against the chart to validate functionality and compatibility with referenced images. |
133-
| Virus scan | Results of antivirus scans performed on the chart package. For details, see [Malware scanning](../explore/malware-scanning.md). |
134-
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data for the chart's referenced images. |
135-
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the chart was built, including build tool, source repository, referenced images, and build materials. |
136-
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, listing the chart and all container images and tools it references. |
124+
| Attestation type | Description |
125+
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
126+
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing the chart itself and all container images and tools referenced by the chart. |
127+
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the container images and components referenced by the chart. |
128+
| Scout health score | A signed attestation from Docker Scout that summarizes the overall security and quality posture of the chart and its referenced images. |
129+
| Scout provenance | Provenance metadata generated by Docker Scout, including the chart source repository, build images used, and build parameters. |
130+
| Scout SBOM | An SBOM generated and signed by Docker Scout, including the chart and container images it references, with additional Docker-specific metadata. |
131+
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys, in the chart package. |
132+
| Tests | A record of automated tests run against the chart to validate functionality and compatibility with referenced images. |
133+
| Virus scan | Results of antivirus scans performed on the chart package. For details, see [Malware scanning](../explore/malware-scanning.md). |
134+
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data for the chart's referenced images. |
135+
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the chart was built, including build tool, source repository, referenced images, and build materials. |
136+
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, listing the chart and all container images and tools it references. |
137137

138138
## View and verify attestations
139139

@@ -156,4 +156,4 @@ These attestations can then be verified downstream using tools
156156
like Cosign or Docker Scout.
157157

158158
To learn how to attach custom attestations during the build process, see [Build
159-
attestations](/manuals/build/metadata/attestations.md).
159+
metadata](/manuals/build/metadata/_index.md).

0 commit comments

Comments
 (0)