dhi.io/rabbitmq
RabbitMQ 4.3.x (fips, dev)
4-debian-fips-dev, 4-debian13-fips-dev, 4-fips-dev, 4.3-debian-fips-dev, 4.3-debian13-fips-dev, 4.3-fips-dev, 4.3.5-debian-fips-dev, 4.3.5-debian13-fips-dev, 4.3.5-fips-dev
sha256:bfe4a2ccf21fb753644a481fabf90516ab8818f594d9f097473b714ed141a2a5
Manifest digest:sha256:129911bf7f299e3b2b0b600906a04fea1abc6f96661c6ab521383c67191742c6
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/rabbitmq:4-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/rabbitmq:4-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/rabbitmq@sha256:8e747e2b9d226d5d5cc32be4fe989ffe21cc6f0e407c43ecd43d28729daf7a19 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/rabbitmq@sha256:490019694ea7f92f2f7f41b40c4ee2c9c3e5716ceca10d6df976f50c08843602 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/rabbitmq@sha256:77aa97217ed2082f3ebb52c9c6128684cf13ec0124978ecfa285c8403b432acf |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/rabbitmq@sha256:0113a0b590ac41a39e95ffcfa4dcfb5ef49e344429e6a0d5942362b4c47b165f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/rabbitmq@sha256:6d928958c986184e9638140389649399434b7400f606f1288400e295623dfd9d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/rabbitmq@sha256:60f13aa3f58f53a14d39fcc3544b51e51147c04c80af2d807388e1b46e1445ec |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/rabbitmq@sha256:5a94d5efae5528a1ca1dcef50f41c0da31105b6364f1b2396f3da23f92b5d910 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/rabbitmq@sha256:007297842781ff6a27a89c9a22b0cc82e8996e19760eae04f01f6659551097c6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/rabbitmq@sha256:edf7bdd8df76781a833f591211ca9e50034b0ba17f8df65f71e11ef326642b2f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/rabbitmq@sha256:d27b70423f7fda1a87aee10507b4155bf09d0864fe89e77649e5567625cc2f12 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/rabbitmq@sha256:f3f396d9474245953c4d8d2b26f277f857db40899f6de1bb19ae86aecbf06a66 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/rabbitmq@sha256:a018203e3b79de14ce43adc5a7b54fb25dff504c768279ed5ca3c8b765b7ca7c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/rabbitmq@sha256:79c7d5cce24400bc8c6e8b667b734f2e85a13b3241eddd15d6e848af18794009 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/rabbitmq@sha256:32676b35df8f4a8577fa5a8ac8c605be1b1782beadde05a145663c67ef761616 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/rabbitmq@sha256:221eb1cabf0165a33566e6e6c79314309ea8453c0239694377037cee166d4cbd |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/rabbitmq@sha256:255d620ed121a00e69d9fcaa470e4a3617c2744c80553debeade4f6ea158a979 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/rabbitmq@sha256:4d6ac59e597d3017c4381adb57f8e8285892ab35e16f6607666e6a566c8584ae |