From 732e2863c2823e394a5266a370dee04b3c901892 Mon Sep 17 00:00:00 2001 From: Craig Osterhout Date: Tue, 28 Jul 2026 08:17:17 -0700 Subject: [PATCH] dhi: update attestations Signed-off-by: Craig Osterhout --- .../dhi/explore/security-concepts/attestations.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/content/manuals/dhi/explore/security-concepts/attestations.md b/content/manuals/dhi/explore/security-concepts/attestations.md index 5e4ffbef6c3..4686424631b 100644 --- a/content/manuals/dhi/explore/security-concepts/attestations.md +++ b/content/manuals/dhi/explore/security-concepts/attestations.md @@ -62,10 +62,10 @@ tooling or security platforms. While every DHI variant includes a set of attestations, the attestations may vary based on the image variant. For example, some images may include a STIG -scan attestation. The following table is a comprehensive list of all -attestations that may be included with a DHI. To see which attestations are -available for a specific image variant, including the specific predicate type URIs, -use Docker Scout: +scan attestation. The following table lists attestations that may be included with a DHI; the +actual set varies by image variant. To see which attestations are available +for a specific image variant, including the specific predicate type URIs, use +Docker Scout: ```console $ docker scout attest list dhi.io/: @@ -89,6 +89,7 @@ For more details, see [Verify image attestations](../../how-to/verify.md#verify- | SLSA verification summary | A summary attestation indicating the image's compliance with SLSA requirements. | | SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. | | FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. | +| DHI Changelog | A record of changes made to the image across versions. | | DHI Image Sources | Links to a corresponding source image containing all materials used to build the image, including package source code, Git repositories, and local files, ensuring compliance with open source license requirements. | ## Package attestations