Excerpt
This article provides the complete SHA256 hashes for verifying Alpine Linux 3.13.4 releases. It lists the Alpine 3.13.4 sha256 hashes for various ISO images and Docker container image tags. The article explains how to use these hashes to validate download integrity and check for vulnerabilities. It highlights the importance of hash verification for security.
Alpine Linux 3.13.4 is stable release of the lightweight Alpine distribution for containers and cloud environments. To securely download and verify the files, you need the SHA256 hashes. Here are the Alpine 3.13.4 sha256 hashes for the major release files.
Sha256 Hashes for Alpine 3.13.4 ISO Images
The ISO images serve different purposes for installing and running Alpine Linux:
- alpine-extended - Extra utilities and functionality beyond a base install
- alpine-minirootfs - Minimal root filesystem for custom deployments
- alpine-netboot - Network booting installer image
- alpine-standard - Default Alpine Linux installer image
- alpine-virt - Image optimized for virtualization environments
- alpine-xen - Image for Xen virtualization platform
10290fd51328f666cc9f4049614bf58334284030d4d8bf1bd50d20afdd972bd2c alpine-extended-3.13.4-x86_64.iso
2
38e21c85c4a5bb406180136aa03f814c56ffc7498ba7886c5ea13fec92d528ead alpine-minirootfs-3.13.4-x86_64.tar.gz
4
5ce98a2b303b6a142ae9ab0a07833abe4a6dbf5ee8461c3c34ed5444587918e7a alpine-netboot-3.13.4-x86_64.tar.gz
6
71731776d9042d0e02ebcba27dc3b83cd1335092ca262ccba1a20213867cadfee alpine-standard-3.13.4-x86_64.iso
8
90412f85766e21ef279c0a5adb96d7c5d1c35e82a5d1d424cfb018cb40420951f alpine-virt-3.13.4-x86_64.iso
10
1162f9e3eae272a7f4bc02f070bb96ccfd820d1f6aa19d6e0040ddf73769ddbebb alpine-xen-3.13.4-x86_64.iso
These sha256 hashes can be used to verify the integrity and authenticity of the ISO downloads from the official Alpine site.
Sha256 Hashes for Alpine 3.13.4 Docker Images
The key sha256 hashes for Docker images across architectures, as seen on Docker Hub Alpine:
1alpine:3.13.4 (linux/amd64): sha256:e103c1b4bf019dc290bcc7aca538dc2bf7a9d0fc836e186f5fa34945c5168310
2
3alpine:3.13.4 (linux/ppc64le): sha256:f3a907bc0278ea0de7ddafcbca3c9a63cee253a4698eb248a4416d46fc906dbd
4
5alpine:3.13.4 (linux/arm64/v8): sha256:071fa5de01a240dbef5be09d69f8fef2f89d68445d9175393773ee389b6f5935
6
7alpine:3.13.4 (linux/arm/v6): sha256:cba24b50b9d81704968f65455897a3a519568b236c174c9040135c5afee5dc54
8
9alpine:3.13.4 (linux/386): sha256:e10c13a5af47b1f2f5e3fbb9355fa82bc1234567a83a549d61d15697131e6e66
10
11alpine:3.13.4 (linux/arm/v7): sha256:59b46c319f3b66dfda96faafd0c6959e9b2f409792d0236204f270dfd0235960
12
13alpine:3.13.4 (linux/s390x): sha256:44f0cac18b69c3867be12e78766393adf801560a102fe0113bb4abc981acf9bf
Verifying the integrity of Docker images is critical, especially for containerized production environments. Images could be tampered with or contain undocumented changes. Using the published SHA256 hashes ensures you are running the exact image you expect.
The hashes allow pinning to a specific Alpine version across architectures like amd64, arm64, ppc64le, etc. This prevents inheriting vulnerabilities from outdated base images.
Checking for Vulnerabilities
The sha256 hashes can also be used to fully check for any known vulnerabilities in these images via sites like Docker Hub Digests.
For example
To search for vulnerabilities in a specific architecture, you just need to plug the hash into the Docker Hub Digests URL.
To check for issues in alpine:3.13.4 for linux/amd64, use:
1https://dso.docker.com/images/alpine/digests/sha256:e103c1b4bf019dc290bcc7aca538dc2bf7a9d0fc836e186f5fa34945c5168310
To check alpine:3.13.4 for linux/ppc64le, use its hash:
1https://dso.docker.com/images/alpine/digests/sha256:f3a907bc0278ea0de7ddafcbca3c9a63cee253a4698eb248a4416d46fc906dbd
You just need to replace the sha256 hash with the one for the specific image and architecture you want to validate. This allows pinpointed vulnerability checks on the exact Docker image rather than general tags.
Consistently verifying Alpine downloads and versions in this way ensures you are running the most secure containers possible.
This will display any CVEs or issues found specifically in that image version. Doing these checks with the hashes provided ensures the containers you deploy in production are running secure images free of major vulnerabilities.
Conclusion
The sha256 hashes provided here give you the essential data to verify the main images and versions of this Linux distribution. Be sure to check the latest releases for updated sha256 hashes. Having the correct hashes is vital for the security of your Linux systems, especially in container and cloud deployments.
