From 84399f25876ad2e952a1f29c671802a99bdd5537 Mon Sep 17 00:00:00 2001 From: Craig Date: Fri, 25 Jul 2025 13:28:37 -0700 Subject: [PATCH] dhi: update fips attestation Signed-off-by: Craig --- .../manuals/dhi/core-concepts/attestations.md | 5 +- content/manuals/dhi/core-concepts/fips.md | 47 ++++++++++--------- 2 files changed, 28 insertions(+), 24 deletions(-) diff --git a/content/manuals/dhi/core-concepts/attestations.md b/content/manuals/dhi/core-concepts/attestations.md index 4d965a4572b..afbba888873 100644 --- a/content/manuals/dhi/core-concepts/attestations.md +++ b/content/manuals/dhi/core-concepts/attestations.md @@ -61,7 +61,9 @@ tooling or security platforms. While every DHI variant includes a set of attestations, the attestations may vary based on the image variant. For example, some images may include a STIG scan attestation. The following table is a comprehensive list of all -attestations that may be included with a DHI: +attestations that may be included with a DHI. To see which attestations are +available for a specific image variant, you can [view the image variant +details](../how-to/explore.md#view-image-variant-details) in Docker Hub. | Attestation type | Description | Predicate type URI | |----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------| @@ -79,6 +81,7 @@ attestations that may be included with a DHI: | SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the image was built, including build tool, parameters, and source. | `https://slsa.dev/provenance/v0.2` | | SLSA verification summary | A summary attestation indicating the image's compliance with SLSA requirements. | `https://slsa.dev/verification_summary/v1` | | SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. | `https://spdx.dev/Document` | +| FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. | `https://docker.com/dhi/fips/v0.1` | ## View and verify attestations diff --git a/content/manuals/dhi/core-concepts/fips.md b/content/manuals/dhi/core-concepts/fips.md index 4b67a57c545..e81aa74de34 100644 --- a/content/manuals/dhi/core-concepts/fips.md +++ b/content/manuals/dhi/core-concepts/fips.md @@ -67,42 +67,43 @@ These indicators help you quickly locate repositories that support FIPS-based compliance needs. Image variants that include FIPS support will have a tag ending with `-fips`, such as `3.13-fips`. -## Validate FIPS-related tests using attestations +## View the FIPS attestation -Docker Hardened Images include a signed [test -attestation](../core-concepts/attestations.md) that documents the results of -automated image validation. For FIPS variants, this includes test cases that -verify whether the image uses FIPS-validated cryptographic modules. +The FIPS variants of Docker Hardened Images contain a FIPS attestation that +lists the actual cryptographic modules included in the image. -You can retrieve and inspect this attestation using the Docker Scout CLI: +You can retrieve and inspect the FIPS attestation using the Docker Scout CLI: ```console $ docker scout attest get \ - --predicate-type https://scout.docker.com/tests/v0.1 \ + --predicate-type https://docker.com/dhi/fips/v0.1 \ --predicate \ - /dhi-: --platform + /dhi-: ``` For example: ```console $ docker scout attest get \ - --predicate-type https://scout.docker.com/tests/v0.1 \ + --predicate-type https://docker.com/dhi/fips/v0.1 \ --predicate \ - docs/dhi-python:3.13-fips --platform linux/amd64 + docs/dhi-python:3.13-fips ``` -The output is a structured JSON report. Individual test outputs are -base64-encoded under fields like `stdout`. You can decode them to review the raw -test output. - -To decode and view test results: - -```console -$ docker scout attest get \ - --predicate-type https://scout.docker.com/tests/v0.1 \ - --predicate \ - docs/dhi-python:3.13-fips --platform linux/amd64 \ - | jq -r '.results.tests[].extra.stdout' \ - | base64 -d +The attestation output is a JSON array describing the cryptographic modules +included in the image and their compliance status. For example: + +```json +[ + { + "certification": "CMVP #4985", + "certificationUrl": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4985", + "name": "OpenSSL FIPS Provider", + "package": "pkg:dhi/openssl-provider-fips@3.1.2", + "standard": "FIPS 140-3", + "status": "active", + "sunsetDate": "2030-03-10", + "version": "3.1.2" + } +] ``` \ No newline at end of file