dhi.io/sapmachine
SapMachine 26.x JDK (dev)
26-jdk-debian-dev, 26-jdk-debian13-dev, 26-jdk-dev, 26.0-jdk-debian-dev, 26.0-jdk-debian13-dev, 26.0-jdk-dev, 26.0.2-jdk-debian-dev, 26.0.2-jdk-debian13-dev, 26.0.2-jdk-dev
sha256:1ad457941b7b93568e73087c8220f5772eb09e1b2215fb1329be20f5cec5f133
Manifest digest:sha256:12d644a5b0235f96b3be5a316f438e19cb9e2891c9296355bc1c5fcce035b2ec
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/sapmachine:26-jdk-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/sapmachine:26-jdk-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/sapmachine@sha256:fa7722f626cc348cfce744cbfb965a3e9e575cb5f960c521c0d635bde33f0125 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/sapmachine@sha256:6e688055fa0f9d1510134ba6715f8dd9995d2565cfcda790733a679f6e2024c4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/sapmachine@sha256:06de3b2326366e8a361b71b65fcd84abd8fc908dbab5c784e3dd602eb011ca95 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/sapmachine@sha256:68532c25df65c38ebc5485a95c6d11de86a2f299b25d586438bda1787e1e9b57 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/sapmachine@sha256:8a828dbfd18e8bd604069100253ea9b6e2bb12061ebf8dca02af3bbdad3b6355 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/sapmachine@sha256:cf85bbfec86f9bbace2d46e40cc7c712568132075ca08c2b4eb077cfa51ce18f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/sapmachine@sha256:5cc3aaa5dfde42914588dfec4b91e08804109e82275be5cdf34d024d9448dd03 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/sapmachine@sha256:59204db98a519c99cc8a2c8a7a96b43fa81b7e809f0bdda5cba6b9395d434c66 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/sapmachine@sha256:ffa2c62d30c4950fe7108f5f4b6371ec172ef679cb83569f995acf1ec9011002 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/sapmachine@sha256:3c657bf957ba8dd27bd9c26953d12a2d80475615c71844c8c6dd5e956a5e1a4f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/sapmachine@sha256:371df1b7c34273fc4000b927bbf66362355171a66c1d7452d2538abc62793810 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/sapmachine@sha256:38903b039ca20da9358ba94e43843d5833e4126312ade82b378a97d2acad3a0a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/sapmachine@sha256:128d50babf71677abeaee4b4f06ba35a672aca85351ec53ad373f207ddd72875 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/sapmachine@sha256:67deb0d162434a30b9ed1ff029e151ab13b19dffad3e78156eaa09f685b20a0a |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/sapmachine@sha256:66c2741dcab7c235e2efb7661ff71c8f80cfa4e0274eae0bd8942066bbb873d7 |