dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python)
4.0-debian-python, 4.0-debian13-python, 4.0-python, 4.0.4-debian-python, 4.0.4-debian13-python, 4.0.4-python
sha256:a48eda33b0588bd370f2ffee3622204681820baaf51767c618ea0921e90c9401
Manifest digest:sha256:0625afff76799b712a3518411b24f49eb0bc381773c2f8d1cbe1915bd5ed7d79
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:ed83df7eb07c3179c89a00df4773f7bee304796c003716a00db64a40f4f21936 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:1bdfd9a61066c6b66cf7576df1d7b7f1a4176c585bdea29d5a90e6d09d78b60e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:d60dafb2188fd3f88b234b3a999a36e1ef75e0b15ddce17c54748fa29eae8cec |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:47a271d983024e76e1f693f4aa39b9f53c7968e055a59d5cce27898ca27259be |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:3766c044ab5da1f3c5e29fca7b4742ccc133917a244ee95f0419337b66946e06 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:c447b40852f8e9fb036d8e6c59c30641d6d4c17b64ad61b5d344468f22b408f5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:225c494d03763e5ccbaac96a29864adf8bb13ba45d39d704e7cdda5c8a27e517 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:929481ce1372d2318dbdfa2afcc91b102cab5c12f2e94d226b76bbfb907e6f7e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:2c1065abc58849440a6ad03ec42ec007048767b87a247eee9e3cb29a66b9922b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:62960b9d2b07014bb303a2190d8a4c790b9dd4065b23af276f180a347914c632 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:11ee36b3f9cda8e4341744758fcb7ce34785c3119ad0dc2156b06e6d55634fc7 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:b1d22528332a2edc091c35c2d9bd419e1a98c5acf31c18c1c4d6663170156e91 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:7506becb00e8b69b51be929ddb56f5a7bbc7ad9f51c0c610b10f150c6daf50ec |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:85922d49704e2e43cc83701528a84355d0f38c789b6fc49145c1a20de92ea871 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:ed034b538c5b3dfe723c14d0ad6bad9ec48dbcf0c3762ff3cdde77ee25214e15 |