dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python)
4.0-debian-python, 4.0-debian13-python, 4.0-python, 4.0.4-debian-python, 4.0.4-debian13-python, 4.0.4-python
sha256:7e2c770528f6767455cd962cb37ef4646db98e4cfc17ef223d9bd6675b5d79e3
Manifest digest:sha256:6f61d3c9f9ffd53e0288732b4ac76a5280681dedffe95da5fc028519231e52c5
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:9b2f998739d44444b3a30199cee2b1d30151e44cb9caa928f89427a33ee7d506 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:e1b008c39db1cfb8325ae2bc5cac8540a636aebc6daa167dd28e42e38c278c98 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:5565bf7a537d1979b4c3815f2a504d336cf324453ae15c9c8d7d3b4abad2f10f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:5181c90a3118dd720d9c7ed4a38d08ae4488de4323486b6ca87dcbd1479b409d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:df386bb8b618412830e9dca249d14526b3ffd4b2a82738e20a15acd7b237673c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:c4e987328d37449e47b654758dff4959f19e9c04280ff32814ee1aad78ca8dac |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:8ad3bd96bd40ab1066c9ce67a8cea913fcc9839905bba7705cd950b89fff3b99 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:25805bd234867994d4158b39abc13ce4ff79907d50ec65d795551f05937edb2e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:2d7bdea27e682ac64e98220fd5a6c4adf4816d580dc09ecaad305b5da76094c5 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:31a75a2d6dc10b0aad811644f3b881ce726f486b2ecb9c57657321d55406746e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:90d6771727527dceb8122dd602b7d5fe657b182759a6d936f59dd10a2c885fbf |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:c7d709c6ea479324f3bf2e5de238a751a2872328189cb4f92db6632ddc66fa0c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:34573aa2b065aa6a2ba887f6c27f8345d88dc75135a922e5cbd6a3a1d5e80caf |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:4e7f166c00920da41ae3c818e01316af22ef0640bb86b4b376b8591e22d08589 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:9ced76156465e91e84cd0f0181673a8929d69bf618fd9d001b599895493abae4 |