dhi.io/dotnet
.NET 9.x SDK
9-sdk-alpine3.23, 9.0-sdk-alpine3.23, 9.0.122-sdk-alpine3.23
sha256:2d6b4955b3d66ab79b7e54d9f76b43adb58fcc7cd412ecc69c64ea0b208fdfea
Manifest digest:sha256:6a64ecb5a9f80f22251ac2e4dfed58c5f97e943e0f63b82a45e5fc41254a2c0a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-sdk-alpine3.232. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-sdk-alpine3.23 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:157ea23b24bbec08f7f042f664201c5113dfb938a7221c35d627047e9a5968b3 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:dcd8a2aff4e79e2a8ff6a5cfdf03b275f99b6bb40e5791b22aee7e3fc07cc862 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:ae421c3d858743361229bdd949fb1a9ebceda6b4e470caf6515b7800c57c064a |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:1bfbf2c126dcf9310d97ebc145f4c25a3cbe405065e4a19c2f371abb690e8776 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:c930c10a8d206bce9a29d6ff1616e214e2ce3a48b862397c53f4f0927ec04dc4 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:4c599ab7526c358cf8784b6bed38369a13ee186f4fae5b217b4f0eecef1d57cf |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:02c7be2fd18d3fb4b86a853728ba8aa4812ce4464ab02d4d845ea5a70747561c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:5f22a20129bd6358476fa51493075a286c277092595f9233c47de7097098a938 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:06ce691dc6d7c3a3f0a2b22e5a9ffaa73c6b85bcecfc9623270ef288995f2b57 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:ed0d5785a7a53034187276e616d2f9c12e771e881651ad78d327ca7ca8696572 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:d5068061a771e996941e42f7dd3f68bc3e583e42f04fe02bc3c4dabe1fc696e4 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:66434371f334249e6cbff56e4d495c9d14c0c601b5e18fb41ada2ac10dc7529c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:288cee5c3b2c8966f6d03309ba9a42cc0ea284cf4ca78478473289a16a066324 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:ee62fcc7e85b163702a2013ca48c0a2de6ec8c21135030f688fc10e10d8e83e1 |