dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python, fips)
4.0-debian-python-fips, 4.0-debian13-python-fips, 4.0-python-fips, 4.0.4-debian-python-fips, 4.0.4-debian13-python-fips, 4.0.4-python-fips
sha256:753e0d2de51b597c1982c0f64d3c2d95c6d18410261876aa273946da748809d2
Manifest digest:sha256:f98fa5840fd7fc0e8aee82ae478100d252f3eeffd3912f259023bf72d631a4bb
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:4f997639a3ce862c38564c90271ffebace58d085c94186d6feab14be8140b01a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:bc01615c385c3cf89fba740249b515036e4617a05c48f83051849bd4df1aa7c1 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/spark@sha256:dcde69a4599176ad2ec8f96c7f1dbb267c5f40db0620d72520161c2b4e6e40e3 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:ea9d44d34b6463d989f1c3d5822c898ec03b72e51edaecd9483d62d6750b6b1b |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/spark@sha256:35d4795563b728c2462470b9a936d8f4dda0883979dff8d3551dd22760d373c2 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:ddc54ef42cd1ca79983243c3bde14b86969f355c1453c2a337dd1f013734ba0a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:442fcb05454adedaaa3a1847d28a59dd2e7aad91c2d966c79b02b0667668078c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:9c33612695b2b82e056b5c7240e2bba32eade9de15111c02291f987cc1022f74 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:09d966483747c13fac93214d5a387b4a827ac502f15abc1b117d7c4c5cdca5f5 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:3d78bcba403fd93718b076852a2a8539e8441e316e1eebbb367a68f02860d143 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:eb79e3c9bcd7bec07ae7cbac00ed5609762fc5316901c740ad9fee08b9601ee3 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:5a2a3b51a06ddde92499ee77ca59fda7cf3b2bb172ccd73e679308b862d48216 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:14beb77b79097d1bace11c74e0d084b3e300571d33509028790a004674151350 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:6a3fad5715cb5de7a216cc10898f7ab08d28153d67c4dcc7370c211c5a42cc21 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:3004c2019eeb6e4b3f92c1ede92b0e07f5ea28a04e07a117f3b6b009955ca8a0 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:7e4ccf955dd846d3772b308cbb9bd67e9a4bfa36007d594bc8741004229799b2 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:2040ca3b0047ecc2bd214fd9bf215e7582a34d7adc30fcede377f52129a31ba1 |