dhi.io/sapmachine
SapMachine 17.x JDK (dev)
17-jdk-debian-dev, 17-jdk-debian13-dev, 17-jdk-dev, 17.0-jdk-debian-dev, 17.0-jdk-debian13-dev, 17.0-jdk-dev, 17.0.20-jdk-debian-dev, 17.0.20-jdk-debian13-dev, 17.0.20-jdk-dev
sha256:0179fde39c2aa0fb7a0b77a97793d6ce86d68b1577d2b71c40bb2e81471d318c
Manifest digest:sha256:8dfb3a9c715d8acf8d4ad3b17758739cbf7f980876bb1462775cf42b4ea6659b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/sapmachine:17-jdk-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/sapmachine:17-jdk-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/sapmachine@sha256:4325bbf76a9e4448a7397d050b40d25cffd7214780b740b7e7b44436de42386b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/sapmachine@sha256:dfbbc2b70768f3b316a3c3efa433b00d7d32882cda1e295dcfb18f0174a7bf35 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/sapmachine@sha256:e9fb5febed9fc0f95092479f91faf28c7e3c68343233853f61e7a4bd570beba4 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/sapmachine@sha256:5f6fc3d06a0c9f95e215f86fee154abbf466abb67b65f77741c13ef0e72a270f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/sapmachine@sha256:bfcb988e0a67660f5c74a97c8d11e609982c9a856c8fc113ed4586f9a6b6eb76 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/sapmachine@sha256:510de2b175694e9be102e9d67daa7ee892cd31fa6a8e3e4e17cf4853097c3f1c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/sapmachine@sha256:c1e10bda7f221aefc6fe174fd61b7c142ffd7eed825488175cf570de249a5315 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/sapmachine@sha256:38b30b92d17c084830fe34efb81293bddedb524a88be2794f897475c0d39a6fe |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/sapmachine@sha256:fd56b20e5aa606d9af528ce408e1706bdfd7956faff594a78ba00c0f046dd71d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/sapmachine@sha256:d4236c71559fa419b03ad8574184e9baca8e4bab1a940febe89cad3a1c33b179 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/sapmachine@sha256:a0af74f9ee30d9625a98fa9f4d0c560075aa66dff43c2b7e40542f51d42ce2ce |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/sapmachine@sha256:e88915286dc7d17b5ef73e63de3b226b7c8ae49a0a9e4447fb9e31fa30870f32 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/sapmachine@sha256:82f65bff8567fdf50c2069ee27c44ee225550c21f857ff87523d47a214da2c1c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/sapmachine@sha256:124c7be2d56ea161d18f498a8b6467a734cc17cccc131319523578d7ba4bab1d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/sapmachine@sha256:e764c79885824389b6fefaf782e60111f632167703064eff345db568b80c8174 |