dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python)
4.0-debian-python, 4.0-debian13-python, 4.0-python, 4.0.4-debian-python, 4.0.4-debian13-python, 4.0.4-python
sha256:db22395d1b3f3fcd3e82f7d112cf7f0cdbe1b179f4992d6da919847b8f761ab4
Manifest digest:sha256:5ff00f0c1f31186b9d5ee85020cf6a637a5ebefaa1044e2125be17b8f702df2e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:bec0797b241e247c076fca546bb283b2656bbb4ffe78c1aba91fb57f45ff0ef4 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:24507e458ebab7f2c20f34d47fbd7a33ccaab5507bd4df70c04e832178298069 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:5315523ba19e1f3da6177e399e91ce319190e955c756ef4620e3e118ff351c8f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:fdb512e4a0cb199ba6639e54d365fdb9efbae8ff3a0cb2a5f1cfe8803c541909 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:bf54b6f0ea4d301bccc5e3804bce35dfdfaf2c5ee4cba37b781bdc703eed0028 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:f70501cb3e14c12fdedfb03467105eab62849c9b2efd5a518e009843622f26db |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:8c5c97056b6a3d1606503e2bcece91b10bb8871a708c4b01810b7f6dfb64e41c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:a1414ad56a2900ff02c717b041c5f278bc5e790d7a2209eee4aa09d16c658d17 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:897a274713d2a14dc51d518e30b641a22e6a7f0ef68e2df29bdadc6e680d738b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:75d92f305b528263d3ce59d93ada8711effd63d7ed8d9b89485255320e140e2a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:8be1989263b69c005b521de710cb7f01efae47c7b17009072576a860eba356ac |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:b1ea8f3c0a36e23993d9b5c0b02afa66929bc148366a591908e554cce96115d6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:c1f992a2e73e5cb1f2eacaedfc4d859d9f555eecd64a133d12e9f00b6cf859a5 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:6a34498889d159f6a9661dd01cb0260d0e44070935dec72a88c7641fcb88bbb4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:b69278c5830021ccb9fb9d8c46747d2985792ee1e75ef062c07669ed666f7400 |