dhi.io/dotnet
.NET 9.x SDK
9-sdk-alpine, 9-sdk-alpine3.24, 9.0-sdk-alpine, 9.0-sdk-alpine3.24, 9.0.123-sdk-alpine, 9.0.123-sdk-alpine3.24
sha256:cb68332330c01b9755d05001208ae1a370843b1ae70a4015cd25bf5d16ffaf56
Manifest digest:sha256:00f941e0ebef72c4084c6ee1f6e1120a24efe3526829831a42b2bdeacd075bcb
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-sdk-alpine2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-sdk-alpine --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:915f53dcd1193241059b3db350f8175376839245078136c7846cdba9cca659c4 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:948f4d56788cee4356d6880474a65968b1fbb611f4ad19dc2fcf595f20d9e82d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:3b42b708ce212839867dbf163926e96cc0a68242d49ce4294d86076d70ad7ba0 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:2ba8e17213ef03bb481ec2c678773d92527a1e9ea69c5bfef9fb83cf057e8464 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:fd11053b2f7845f7f5b35adc988c68efc4b37734e048f71781e0279a7bb93115 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:7f0770a8d5b3de8598fa56fae63572061de802956728020973e441f7974a5465 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:94add5988cc4f479fb628ba1d3ed1bac3dfb91ba340666a3d46d57797734c101 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:6e9a564a3919a8cdfec4be528c08f01e21daa9f9e5f7606b6245ee8402a8ac05 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:a99887e371f28c04c9e3778696a66172dbf6916f6be4e0eac53b5a93307c941b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:c41c46ffbc2e44320263a94afab6a3b2530d93d8215c769918343c7d07d8b704 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:2a8dad328fae4a83feb9c85f1f99f923136ab7de10b12a369821ba49ac8c777b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:99c55d54dbb2959f450183baa7832924edf5a34f71989d4b9293ca0f245750da |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:d2c37884146e02cd760abdd3f0c9e53310df61e0800605a45dbc8e0a47d6b938 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:44788c145d254731fb7928af627b91886aa337c1179fb8c0fb90c7b5f0b6bfbf |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:d007ba3add9ad695cf011ad1c524cbcdcbb32948900d9de78c27309446f8ac3b |