dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python, fips)
4.0-debian-python-fips, 4.0-debian13-python-fips, 4.0-python-fips, 4.0.4-debian-python-fips, 4.0.4-debian13-python-fips, 4.0.4-python-fips
sha256:6a0e8d5cf23e5417cae6a232125180c6d65c309617d639802d4c715ef8b0fd59
Manifest digest:sha256:0a3b3dcaa1c8de01ee5e786c210fab75bb6386639a24b8eca2bed4488919b7b1
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:c3bba6e072e83f0fc9d3f52f8229da9dd9f6fc7b498b943b1a56a39c30f24efe |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:8888f7d32ee40fcd4af88d299eb79d5014fcfb50aaaff6a06d50e51a4cdf83bc |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/spark@sha256:e57c93196589733037fd73c358a55ce9f72008c053ef59a16921beac5d56ea92 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:bbc844b048c5bc27c64e804c30d06bddd38a735dce12bbdae10abfe28142ea2d |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/spark@sha256:8a5cb5380dd325defb50ce8ed72873613dd20b501cca912e3a741546254f7312 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:1d5aac391e75821afc253ae03b680503caf13b927c2b6913feed909bf7604d98 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:48e52500930fafbcf476c6d54cf5d13e6e307879c31d5f34c9c67b8b2bc6bcc6 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:2a0de4485372b5f85d9edd269a92b529fb1162d57fc8e0f41c938c8145ae2229 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:b40f3e9a8c4cb099aa09becf24edd98b24f89d60f81b6e30b4220f36fd526cfc |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:f12946a8c76a70569fc5ba36e81635c8010c861d7328b1a72efc40b40db598ff |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:e96278117b6e9b154bece746b7d493d0e1174c40e4450d53b739f1cb848152cd |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:1306a148e288e1b0b8889e9a6ab743468a0bcb5e7100f2368212349d9258bdfe |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:e9754decc89125a36635efdf079f827b2ee7e7c51a118049f0673d469055b3ee |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:599f6a4770aab85bea65596c26319949a7f19825bb4e526814ddd5fa47ca928c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:6f94c4e4c14cfdc50468e9f53a09f3fe963868c10e326fa371a7268a6190de32 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:b7b56e1bae9e27730ba79578feb6c36095471c334dda3d3f1be89dff8e9e6353 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:b2021dfeeb0cfc482a0f213f74e31abfde1ac59f8f4f126ed581ddc2a93c7694 |