Container Catalog¶
This catalog is the authoritative public index for generally available Indian Hill Labs container artifacts. An artifact is listed only after its distribution location, immutable digest, support status, assurance claim, and verification instructions are approved for publication.
Availability status — reviewed 2026-08-30
No generally available container artifacts are currently listed. Engineering candidates and private registry artifacts are not public releases and must not be treated as supported products. This page will not publish example image names, registry paths, digests, or assurance claims unless they are backed by an approved release record.
Required catalog fields¶
Every published entry must identify:
| Field | Purpose |
|---|---|
| Artifact name and purpose | Distinguishes the supported workload and intended use |
| Supported versions | Identifies maintained release lines |
| Registry location | Provides the approved distribution source |
| Immutable OCI digest | Selects the exact artifact rather than a mutable tag |
| Platform support | Identifies supported architectures and operating assumptions |
| Release and maintenance status | Communicates whether the artifact is current, superseded, or retired |
| Assurance level | Identifies whether the exact digest earned Secure, Hardened, or Validated qualification and links its bounded claim |
| Assurance evidence | Links to the applicable SBOM, VEX, provenance, scan summary, and signature guidance |
| Usage constraints | Records required configuration and known limitations |
Tags and digests¶
Tags are convenient discovery labels and may move as releases are updated. A digest identifies exact content. Security verification, evidence retrieval, and production promotion should use the digest shown in the approved release record.
The distinction follows the OCI content model. Consumers should verify that retrieved content matches its descriptor digest as described by the OCI Image Specification.
registry.example/namespace/image:version # discovery label
registry.example/namespace/image@sha256:... # immutable identity
The example above illustrates OCI reference forms only; it is not an Indian Hill Labs distribution endpoint.