dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python, fips)
4.0-debian-python-fips, 4.0-debian13-python-fips, 4.0-python-fips, 4.0.4-debian-python-fips, 4.0.4-debian13-python-fips, 4.0.4-python-fips
sha256:cf51e506837c602929ad0379d670d8258e1f1c02cea841c0264c9f52f1379847
Manifest digest:sha256:3c41cbe5a2bd90e0284c0e8c28aaed2512b3810ba131440928a8a60f528f3a2d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:a0bd0d22c72317fab6fc92765d824683677a5f4bc71cad20eaa2b82685fc6a11 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:c7ed2357c8529e9af02a802963679247df038847884dcb2d28965395de7bb47e |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/spark@sha256:554ca561185ee08a81fe4d00baf6d99a3a29334ce14a168c5c5404e5c051fcc5 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:e6852e37482a5b40095cb3a85d74b52c6bf96fb2f4afbf7113fce05c43fcfedc |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/spark@sha256:c9402246db0ea8476c0835b00506e5a78f6803933044b07f53e752d41b15a322 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:53e19365460c2b539e39f6fe0d8cf6eb86ed32208bf15ae7f5bafed22c686989 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:d953ca2d61ce52168916b5c1b31f5d6be409e1d0721e2f554a71ec531cf78cec |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:a50e683400934a8a31d2d9d163631d4b5f0242faf4d3fc6c5436b45687abaa3f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:3042091457b7b76eb4e1c09b28ce9f573224bd3c8aeb6349dd200b5659b0ca9c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:edde1bde05bebe4795d48adac2fdd70b1f4c0e6d9058279fc02b7831aa638a27 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:8d8f2548d29476b71a9bcf3728b4518e2f268ef1ee99d7b015838c0b39ab56c3 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:1d110355d4dc2cde6a9710b5fe23dedc804cb306ff103e505d9628d4defd5d5b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:84fec1c1d2ebd2aa71dc1b514a5cbb794c27cc3d5c4efe5b41d878cfbb7f193f |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:e3eaa17e01273f1af5f3eb8ad4c9916009716421969f7367685ec2f17fc63e41 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:2e6fa5b39a4821f382d741bf08bfe78cea1c7489e04f9fdc3101a7455b2aee4c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:dfed508a5071211dfea70cc379539e55e1b62b1454ca228f29e1e62605d71646 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:1f137d6d8c35bba3e8023c017ec104f61048070c90de3d6913b0efa89233084b |