dhi.io/dotnet
.NET 9.x SDK
9-sdk-alpine3.23, 9.0-sdk-alpine3.23, 9.0.123-sdk-alpine3.23
sha256:2917dde9b058352ce79ccaa389ba0f31f02bb2f8032e92f9af8571268e92b95b
Manifest digest:sha256:a894e64f6e3666da44bc217f8acafb2c41aaf51a14dbcbb8bc4766fc8a9f21ad
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-sdk-alpine3.232. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-sdk-alpine3.23 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:9a07c99deda6419b390dfa46b4e2c90fa45b1f7384b282a739ea4bdc3659e425 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:99c09b8802cf27dedf0ba2bb6da33b24ccda1bc6c9b0b4074ae5911025840f56 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:de5a92ea55fd26f8e7453ef87eec6369aa5e55c52b3a793eaf8077819c413313 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:3044fc90b6113760d2f8c5f228e3769b9f488f3bbf2872038ea1be90a6e3dac0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:28a45d8210fbe213a13b0bbc56101dcacca72209b98dda449e32b18686783811 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:7da963968014f5aa5dae369f8e77b17906bcb0069154289f9b01964193396944 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:f15b94c901bea1c9ceee5ed6e41d97e79b0e4431ad57c8433c21585816859c23 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:eb74e42bd11ba2a2b0557d233bcc517875956155b2a1e5a69702a6d314be1c37 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:c3d15151b9104f964b42a0786cb7fac511ec66a1e4f16c6e1f01cd97eae8d9f7 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:0ef3c31ddbd0d6c5efc489b8c05aeffd548af866c1895d30d4f29e05b08da09a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:5250d46b7b6e98172f5201d6dd35b39339c9a0ccb08809a0db5887ee6620e7c9 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:721f559d52bfc05b7a39bb9f813e202bbf1788c76f3c0c2fcf4e733269901d1d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:1f0ccf1c6c6075e07be9333e8b5b0d844586cd7fbe70427aba7f97619282e058 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:d5a355ac85c0d009e328b58a1e1484a994839efadef6dbc54226b6ca693089e0 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:f94342dc2502dcfdf6f0562f99d43cd9702ed183b8eac9588639835cbbc5fab8 |