docker-cli | Minimus Image Gallery

SBOM Signature

Verify this image using Cosign to confirm it originates from Minimus. Cosign by Sigstore is the recommended open source toolset for supply-chain security.

The commands below verify latest. With a subscription for this image, you can verify any version and its SBOM. Learn More

Get Cosign

You can use the Cosign image offered by Minimus or install the following locally:

Cosign-a command line utility used to sign software artifacts and verify and download image signatures and attestations.
jq-a JSON processor used to format the signatures and attestations.

Verify SBOM Signature

Run the Cosign command to verify the image SBOM. The command uses an architecture-specific digest ID.

Verify latest

amd64arm64

cosign verify-attestation \
    --type https://spdx.dev/Document \
    --certificate-oidc-issuer=https://accounts.google.com \
    --certificate-identity=minimus-images-sa@prod-375107.iam.gserviceaccount.com \
reg.mini.dev/docker-cli@sha256:734e7f0d92fa34245cb2f515cc2b655315c0fda46d4ca266b86027d3a9e0c63e

Expected output

Verification for <image URL> --
The following checks were performed on each of these signatures:
- The cosign claims were validated
- Existence of the claims in the transparency log was verified offline
- The code-signing certificate was verified using trusted certificate authority certificates
Certificate subject: https://github.com/minimusio/images/.github/workflows/build.yaml@refs/heads/main
Certificate issuer URL: https://token.actions.githubusercontent.com
GitHub Workflow Trigger: push
GitHub Workflow SHA: dd163c4c4cd40309e9125158ed8c4698680d931f
GitHub Workflow Name: Publish
GitHub Workflow Repository: minimusio/images
GitHub Workflow Ref: refs/heads/main
{"payloadType":"application/vnd.in-toto+json","payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0Z…