dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python)
4.0-debian-python, 4.0-debian13-python, 4.0-python, 4.0.4-debian-python, 4.0.4-debian13-python, 4.0.4-python
sha256:6c385a980ae3a03af1dbc8f19ff1893efa3e0d0470d11bf0f4570d15577eaed6
Manifest digest:sha256:aa2ac7346d3f2782340ceb6f7880856905cfbe6d97c770b064d573e2c414655f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:21c0ce0563880db498d573d38e14c5081d92975b823056f3be5e4bcbb4a1d63a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:713e23d5a16ee69c37f6e49a4d183fba6df1b9f46d9111d6dc00a067440087e6 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:085b9155ebddc21acdd4683c5d8efee8585f08e4cc464d13237fa01905f91780 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:ab7ca845e193673ca6b5c8818908a4753ace76ee0d054e78ac0386a4fd851233 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:e09e3528ba8ddabc2ef542a77b039441c52100d802a884f46e4787f4b8709220 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:515c21da69bec7575b471776f70411dfae143a97e5c608fe6e38a36782db1066 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:a07a3104c0277de7b71e8c38cb5d65e1e34db5557dafb23551f1c1c2541d6e5b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:45df8100bed56d1eff33346c8c4fda5629cccbca5de247ad6770c4522e7f6a33 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:59eef4be89d45c1a626a513241a7e31c89b374c04e9039ca1f36a14f3cf948f0 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:a73eb29731991487098b6062909b602550b4490824e973f3223a2706d942ed03 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:fadc719923455069027de70999867c93fd54cc83c3723e36abdf99f1fb01e82e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:8d808c9f7862d62dc144ded669307155b0285144cea7857838b1f76adffd5571 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:093952df499fc7071e460a39081bf8a0672e2d6d22a75fa46c0312c7f0f98c19 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:3fa3b96f165287b79316ef884e6ca263afadc683e1c2028ed3c44f7904b4a17d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:9220fd6fbb58b08cb40da4efc082a9189ee5d2812c1b07aa50a35b49748fc5b0 |