dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python)
4.0-debian-python, 4.0-debian13-python, 4.0-python, 4.0.5-debian-python, 4.0.5-debian13-python, 4.0.5-python
sha256:c88d1625bd7105cd86ac10e8ecf2977b5226241df883bbc6cafd70f2ab6464c6
Manifest digest:sha256:c6f2c888cc95d21e921249a130b2b18a8491068dba88f4431c87b89f8966e8a1
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:985695a945337462301f86171597177e5ba83c22daecd859a8815b50bb678d2a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:ef2a959bddc350bab4d528099424b22f1caab21432272457aef00eb285a65ef3 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:7a4841e0269167abd2c1c32686ee53eb571f99a2b83911b35195525cbe30027e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:15aff1fd8df18c53cfceda95200c54a7474f79392fbbc12a028088636eff699b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:e766da201c12f3cd66b344957f079226d9d82e0817ebc7b787a099657d62cba6 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:d0fa755ec3f3c7c791dd441c0ec12e441a8cb14469e892b134efddfae10191d7 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:df12d6d062d535749be8a0e6b2d46f78a3707cb6e7103216bd854de5f45b457b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:80b2a99e395a2c713d9f2b783ad98aadc37384081c9067ff9f080ac4e136a607 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:caf6797034105cf89ee5f0f9251e2a247f14f0ab7cb0a7873ad58634a8393174 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:5abd3dbbc429f6162295f7c842e7b9ce68f953a9a5fd30607d16fd8debba8e55 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:93423d5625658d95e6651daf187fbeb1adf7d77f9d1286c90e5f2a663c7d7f79 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:b41ff7c8926184a7147ce2484173486bb70a23da4fa25cfa0fb6614a13fc57b3 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:9c14c541108fcba09df06cae0d8bf96f9e7c5dc301cf8beb77e96c7616e54764 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:302a31fed6f70b2733ac09f63d2dd9dadef6b60d55237e519272cac812b4044d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:96ba4444c4defcb3e4cfe0fbd95e87ea525c61079dd5dd5ee0eb3b480c49d343 |