DHI Policy fails to validate base image verification summary attestation

[zx8086]

DHI Policy fails to validate base image verification summary attestation

Description

The "Valid Docker Hardened Image (DHI) or DHI base image" policy fails with "1 deviation" even when the base image has a valid SLSA verification summary attestation. According to the policy documentation, it should pass if "the base image used in the build (identified from SLSA provenance attestations) has a valid Docker signed verification summary attestation."

Environment

• Docker Scout CLI version: v1.19.0
• Platform: darwin/arm64
• Base image: dhi.io/static:20230311
• Built image: zx8086/authentication-v2:latest

Steps to Reproduce

1. Build an image using dhi.io/static:20230311 as the base image with provenance: mode=max and sbom: true
2. Push the image to Docker Hub
3. Enable the DHI policy in Docker Scout
4. Run policy evaluation:

docker scout policy --org <ORG> <IMAGE>:latest

Expected Behavior

The DHI policy should PASS because:

1. The base image dhi.io/static:20230311 has a valid verification summary attestation:

$ docker scout attestation get dhi.io/static:20230311 --predicate-type https://slsa.dev/verification_summary/v1

Output shows:

{
  "predicateType": "https://slsa.dev/verification_summary/v1",
  "predicate": {
    "verifier": {
      "id": "https://github.com/docker-hardened-images/definitions/actions/runs/17140723538/attempts/2"
    },
    "verificationResult": "PASSED",
    "verifiedLevels": ["SLSA_BUILD_LEVEL_3"],
    "slsaVersion": "1.0"
  }
}

2. The built image has SLSA provenance that correctly identifies the base image:

$ docker scout attestation list <IMAGE>:latest

Output shows:

Base image   │  dhi.io/static:20230311
...
https://slsa.dev/provenance/v0.2  SLSA provenance

Actual Behavior

The DHI policy FAILS with "1 deviation":

Policy status  FAILED  (7/8 policies met)

 Status │                              Policy                              │           Results           
────────┼──────────────────────────────────────────────────────────────────┼─────────────────────────────
 !      │ Invalid or Missing Docker Hardened Image (DHI) or DHI base image │    1 deviation              

## "Valid Docker Hardened Image (DHI) or DHI base image" policy evaluation results
The image must be a Docker Hardened Image (DHI) or be built with a DHI as the base image. This is validated by checking the image for a valid Docker signed verification summary attestation or by checking the base image from SLSA provenance attestations has a valid Docker signed verification summary attestation.

 Message │ Detail 
─────────┼────────
         │        

Note: The "Message" and "Detail" columns are empty, providing no information about why validation failed.

Additional Context

• When checking a DHI image directly in a different org, the policy shows "No data" instead of evaluating:

  ?      │ Valid Docker Hardened Image (DHI) or DHI base image │    No data
  

• The web UI (scout.docker.com) also shows "No data" for all policies, suggesting a backend sync issue

• All 7 default policies pass correctly; only the DHI policy fails

Possible Root Causes

1. The policy may require a "Docker signed" attestation specifically, not just any valid verification summary
2. The policy evaluation may not be properly traversing from the built image's provenance to the base image's attestations
3. There may be a backend/server-side component required for DHI policy evaluation that isn't being triggered

Workaround

None identified. Disabling the DHI policy is the only option currently.

Request

1. Please clarify what "valid Docker signed verification summary attestation" means - does it require a specific signing key?
2. Please provide more detailed error messages in the "Message" and "Detail" columns when the policy fails
3. Please fix the policy to properly validate base image attestations when the built image's provenance references a DHI base image

[lemeurherve]

Related:

• Docker Scout fails to recognise DHI base image #212

cc @cdupuis FYI

[zx8086]

This issue appears to be related to #212 (Docker Scout fails to recognise DHI base image). Both involve DHI base images not being properly recognized/validated by Scout despite having valid attestations.

In my case, Scout correctly identifies the base image (dhi.io/static:20230311) in the attestation listing, but the DHI policy still fails. The base image has a valid SLSA verification summary attestation, yet the policy reports "1 deviation" with empty Message/Detail fields.

Additionally, the Docker Scout web UI (scout.docker.com) shows "No data" for all policies despite:

1. Organization enrolled (docker scout enroll)
2. Repository enabled (docker scout repo enable)
3. Docker Hub integration configured (docker scout integration configure atomist/dockerhub-integration)
4. Image pushed to Scout backend (docker scout push)
5. Environment recorded (docker scout env production)

The CLI evaluates policies correctly (7/8 met), but the web UI shows 0/8 with "No data" after 1+ hour of waiting.