From 06674c733b84f20824b4673bbc0de0839b642844 Mon Sep 17 00:00:00 2001 From: Daniel James Date: Tue, 19 Aug 2025 09:10:15 -0700 Subject: [PATCH] Fix doc link to dmverity-vhd tool Moved to - https://github.com/microsoft/integrity-vhd Removal in original location in - https://github.com/microsoft/hcsshim/pull/2318 --- src/confcom/azext_confcom/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/confcom/azext_confcom/README.md b/src/confcom/azext_confcom/README.md index ba173e90365..458b381de6e 100644 --- a/src/confcom/azext_confcom/README.md +++ b/src/confcom/azext_confcom/README.md @@ -317,7 +317,7 @@ az confcom acipolicygen -i config.json ## dmverity Layer Hashing -To ensure the container that is being deployed is the intended container, the `confcom` tooling uses [dmverity hashing](https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html). This is done by downloading the container locally with the Docker Daemon (or using a pre-downloaded tar file of the OCI image) and performing the dmverity hashing using the [dmverity-vhd tool](https://github.com/microsoft/hcsshim/tree/main/cmd/dmverity-vhd). These layer hashes are placed into the Rego security policy in the "layers" field of their respective container. Note that these dmverity layer hashes are different than the layer hashes reported by `docker image inspect`. +To ensure the container that is being deployed is the intended container, the `confcom` tooling uses [dmverity hashing](https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html). This is done by downloading the container locally with the Docker Daemon (or using a pre-downloaded tar file of the OCI image) and performing the dmverity hashing using the [dmverity-vhd tool](https://github.com/microsoft/integrity-vhd/blob/main/cmd/dmverity-vhd/README.md). These layer hashes are placed into the Rego security policy in the "layers" field of their respective container. Note that these dmverity layer hashes are different than the layer hashes reported by `docker image inspect`. ### Mixed-mode Policy Generation