dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python, fips)
4.0-debian-python-fips, 4.0-debian13-python-fips, 4.0-python-fips, 4.0.5-debian-python-fips, 4.0.5-debian13-python-fips, 4.0.5-python-fips
sha256:c8bb952b8643bdaba81d863561efa63278f04b7e94129d528c914e6d561eb6c2
Manifest digest:sha256:6e80e75f580224fdc00af384380a7d4206d3cb2c070802a0acada210d749ea50
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:209f82131485e3e4a892c2a86586128dc170150d2b04c2078eab0d9f1100f2e4 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:d6e15e14d1d1b704f76fd74caa029d567fb10ee973f4b2aaefdc6180632e0da9 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/spark@sha256:9313d1fa15aac33a34121f5ad184cb07fef63d9ffceb47c8c8adce2bf101a00d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:4f88953727903678cd2306c8aefff565cc81a85d772a6a968dddfc8c2b756598 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/spark@sha256:09a24b4789308e2c98691cd000321ad19daa833a765da048549f61351c74b5a2 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:cadb3e45dc0965fc8a260fd2ddc00ccea484b48e903ffe905678a30f92b630e4 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:38b1f776aa38dbc3cfbcad33a265b82e61b4d3f302d9c5ba26b14b90656d9c4d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:3f4b0dadc193ad105643695f6ef2017a942a72af3794725a5f0cb097d317a519 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:e46943418f7f35c5221479f119ad3a536036b1d826838e2659c20b117b2dd4b9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:207b770ba8026aea1a2ef7f3e328c73977077c181287322f6cb582fd5c34f8bb |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:afcdbefcdccd29f2b4462632e13f161bc01efc9559a92f499d31ca32bd3b98a9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:a2573ca03210e10153e0899e975fcaf934b466a3c92dc873e420fe3903b61149 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:e92d10aee10dd59b7cabf8d38bd3cd1f8d84e9de87b7fff40318a77489cdc26f |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:f784af21b72a4b13a34b03fce0b67a4f29bfbebfeff3ae48f51f13f409b0f5d7 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:3bf837ce97faa63f4c116d8ed7c9bcd8784b958746a86e7326160309002b84cd |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:b0b2658a41bfb423456d3f6de859cc7295612d822dace58b3a804cebe557b922 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:2821d94e916af9d501fa81711a2fb1a2c74ea4e32e9a689d330d033d41088baa |