dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python)
4.0-debian-python, 4.0-debian13-python, 4.0-python, 4.0.4-debian-python, 4.0.4-debian13-python, 4.0.4-python
sha256:b4bb147a11cda769e3b8102409c56049664b0b7ed85d2933631798dc5798d3ed
Manifest digest:sha256:e90890131f86489280bc9cb65a1f1f759719310575644911eab83f254c302e26
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:97f67da20984442b439637f6fdd5094c04eae15b5efb2cf80ec32f4af9e9c389 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:89795e8d594cab10b0c41b6b43b1acecf1d3225e205fc22ed22b573ed7b5ead9 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:807cb288490279aca92249db07abf91e07f3d185f537e0e50a9882cac0684e04 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:cb555746f93932e0e5171f84fd6cb6ff4feaadb485e7f63529ab62c2badc815f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:558f36914168e2f8ba0aefb4de892817716e17c03828eae2e0022e9e2f9f5727 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:e60a448f7c181805524d804c431f9921b5f06335471c366e2ca8b43c156624a2 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:0b120af9405b30c7e6f4307aae6399dc2e3d58d1a4e176e754a705d3cab714d1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:44a7bff6fb2baca3f69b729d1b1c0d772c1e0e104c37042bc4a578509dcfa380 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:f5d5eedf3753d7809dc7c4b848133277d05f48a1f50fe725d1652af5a0e2d591 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:c3a02f958b2fd20bbe73ec5c3f3355779f79e7ff66c39f0f83ab2f2bc2d73203 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:c8152f3dde8870ee4541ca68fc89e955c98a298f72716ce23d71093826031f00 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:b7e4f3f493e5074d6d4101bae3246dd24b7f83204d4df860c1f3f9c70a681431 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:51433d113b2d13625f412ef9bd6f86f01bc6642155064f6aded97ca6eaec7b18 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:afcd91a1624b99d7b759efe5458b606b76d51fc3c55ee74746c25f004ca32583 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:95313d7dc936b6224e164e9dbb1679b9bcb75938a3aa3f1c0f2aa4bdf3849df9 |