dhi.io/dotnet
.NET 9.x SDK
9-sdk, 9-sdk-debian, 9-sdk-debian13, 9.0-sdk, 9.0-sdk-debian, 9.0-sdk-debian13, 9.0.320-sdk, 9.0.320-sdk-debian, 9.0.320-sdk-debian13
sha256:0c77856034058b6b6dc77efb4eb420314e3f0edc624f7ea2e5686d5b70c0c04d
Manifest digest:sha256:90800d3a558e53769d9ca6a00208d64a045249c45f3df90b23dec3724841cb5d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-sdk2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-sdk --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:e9193186f19e4cdc9993aefb7a33d164f7985067fe78ff43372433e68e7d509c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:7c8b6ff8be097da8ddc1978e2c00e9df705c3578606ff84f6c44552e8d8a80fc |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:d85432257ae2b8cc8da4232c1c24713939cf3fc93ee0a824281a7883fb5f2c32 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:f8e5d89f71ed741b8c723e305e8d27ab33267c271df777c743c93338dffa5c6a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:3dbe003f72b3cadc293dcb67ed742592c85b20c1a3a458993294f7c68064716d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:be18bb15b333d2884c01da266a1d8c2c152524dae7846e382f7feab92a2a487b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:10f1f6b78ffd61560dcb45175847928824b91ef6cf3c308378ba9becd5ca2dc8 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:7b6e9677f50d70641d3d631d2a33513938308a77fea3365f01b1a12b9b76c44c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:cdd7f7b878e358b41e968a0b37017a7424a4cbad62042c604b4fe07f39da3025 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:9bd4afdc13a425d855ce7cc738c60c2ab74ffdebba97c389a239c0e2fedd5d31 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:686f8080cdc8113b92f81eea67879ef939089d848016441854a7cfbd5804ef92 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:eb89232967e83e2a8d2faf874b9f4148db767bac890488ada5be2f64fef1b9c5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:05e49fd3847fcb8e9d33b216eb7d04889ac4a1641e852ef7c273a52b71d10e78 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:7adc62aee5955f5efda94c497af1b3e0b64a61dd05fe0184bfb013d86f25e33c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:5267e96887f388feaf242062ea4b12079acea160fc9dff93d5e1465a51384446 |