dhi.io/dotnet
.NET 9.x SDK
9-sdk, 9-sdk-debian, 9-sdk-debian13, 9.0-sdk, 9.0-sdk-debian, 9.0-sdk-debian13, 9.0.320-sdk, 9.0.320-sdk-debian, 9.0.320-sdk-debian13
sha256:bf8b719a86c5ff7c60a40c66e1709bc33642d0517429fbe8a50c4e5d125e1a53
Manifest digest:sha256:b833c897e4db19cfa3a068afd846b2ffb5e722df1f2d36cbfe9fc8e58b2d0c63
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-sdk2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-sdk --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:4d09a082d1d55361bfb86ed8969889bb7a88bf01f738c57aff8d2aea012811e5 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:1cf91091210e49041b76ee48dfe17c4dca31f05330689ff4354b66502926fc4c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:ff302b090a42fb697528771f8a6f592e36575adc4d42ce90c3cd6c941f1a0ec5 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:4db4b7418a5cc3d9b9268be3d638c3b71a68077211c7a7913e1c31c75abb112a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:ea77f3bfb7836a06693a97e44c2b29be6a36916a4f47d6f22170b5f5b59318d5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:66e8a711ca60b73f954b431980ade5e92c43b2da76cec0d57162d284fb6c5b13 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:554e29544a40a1811de097286057a9b4a926a6a594709af9896f3d91416d9ac9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:5e832243bc32e47145b6a0325d0412f5add29cd72a92b5a68eace7e8b5a345fd |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:7a4ca579e7a14107bff0a0febada3061a63a90dd94b4cc129cfbbdb64be72bb1 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:e34fdbedb66a882217984672ac1563af5c4fa1c057cc431d18ce2b9c478860a7 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:80f0c506b5b1eb3ef08f99220235681542987131fc4329eec5ba0b284a5083b8 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:c62e731ccfff620b930322d67481b7040f99e780634de336ca49f81ca8d66219 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:07730d4c96a7092dbd3a6b64b48650e974d4231caf3ecdd2cd6f10fd326f22e0 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:bacfdaa9df4974a68a0eb0701f816f788fbc759bd9281a02e805a39173352003 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:a1331b7f60bc6bc89a773388db2deb1f02f37030107843ffb35486c556f86124 |