dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python)
4.0-debian-python, 4.0-debian13-python, 4.0-python, 4.0.5-debian-python, 4.0.5-debian13-python, 4.0.5-python
sha256:6cb6494450dcbaece024054767979b6058b60001de19314562b8979340dbabcf
Manifest digest:sha256:e3afc573689f6cced181609799833b68e4085f8b81d9cee408da4868fa8ccd3e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:16b694fbb8a962a840ef0483042235362c428643caef93a6a93de2ae26502570 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:d8300901bb87f8a7e92146d9082a9e91f87ff58b7e45226f592d8e95e8020fe5 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:6198886772641306c0a0f29a86a5d2f9277a2f9e485efc575ac8764b20d6f180 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:92bf6d0a9733b4f830e183952e569d5f469411fad8936d88b4c0f9be231495b7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:2b650b7c177d120653bc215fb762f1684647d0e1a60bc59df1c1cdace6622abc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:ac537b3481c799eeea3c0d3d53c1d67a16453b570f02c8636a06f8fcff1edbce |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:c399ec2e5fba5e281f6e92f74892a7f8ddfc13aa7e8478d75ec40f53bf81604f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:1a74f88ee87fbe11d553c18cc3c138e6bc845048c86669a29571dd5bfd6f8ee7 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:4653098f5f0316302ee23fe00f9057a2000195e764e7152dba839f50accb6af0 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:1bacf6a2a34f4ee9bd9b0a4bd54529415356abccfd5bb2a6c09d5615ced53de2 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:dd3725aa90d94f6e45828951f5864714fd001356b7b0c4977cecc41500e3d4b4 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:e0665bf6fad47b74d4112ed95970b5750f961d4cb682f9e45d2c83e800c826c0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:be3941d42ead19018b21520dea6b27c9926acf68bf3300faa3125f56cd0569a1 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:fc0d36c7880640541c598391717521ea575e1815930ebb66609d870f7f37f35e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:27ac0935e90f292edf78ad31ff15151216deaf50850a99d82a1836e1aaf20429 |