dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x)
4.0, 4.0-debian, 4.0-debian13, 4.0.5, 4.0.5-debian, 4.0.5-debian13
sha256:8d679bb02838692efbed368cc513b899bc75e6f4aec54986217f3be1bf2d364b
Manifest digest:sha256:9fa2cd979aa9f9b367e266179c55e056d0ccf8c98aacbd3e66608ac923b47c46
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.02. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:823792b4e8ac9cafd758cc0277b2b2d63892bbc13a1136e738388dbbd6349438 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:e79d17cf7d6a908064a30ead6e1714816980582cba938e02b4e96b2c67d53316 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:ac098606fbfb98100fcc94a4c39aec515bf705ee38b07eb29f5b56c9deb0dcd4 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:b5c2a3d90f5163e060acb930e44a0b1ae98a66780562556133ead69d6c7689de |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:7e8cfa3cefa8af202138187009ca3fb7c3eef5109885d8de4d2982e240e61c75 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:d6c52fd4f63488f10b93d082260a25edacc9db83cd2bcef91887a7084ddc8683 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:f244b7fffb42fb8b5bd0e02d2f5cf6e26a8c47b3682dd8f4753e199d3092f16c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:9d34ca17ba95002fbd6fd1e3804709e0df9fd6cbf99571a61d2224c7f3244747 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:cbaaabafb9d3c66784ba73c4ba46c95b5a3860cd017578b80012f71f369e51b4 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:8366901a29cd7db19686d38c816959f62097c6a6790b23f082eba609052df041 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:097dcb6f511319c0062ca460235412b8b29633066945e9b49e9f9839eb95eef6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:53fe82896e5d04c9655bfc91438a5744e7db9679df8afd84f52e74b4459e4fc5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:7ab05355abc5810795c2eb3ff18804050d4385cc5d068da97cd5e42e2e358dc8 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:c326992f9fbdfbf886ba7e03c1288c09f8fb6f55b923d0086b8d7bc83e58e75d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:73a0bc0e64635df71ed455ba693998ff3a93a8b6dbf0d8d36882625038420ec1 |