dhi.io/sapmachine
SapMachine 26.x JDK (dev)
26-jdk-debian-dev, 26-jdk-debian13-dev, 26-jdk-dev, 26.0-jdk-debian-dev, 26.0-jdk-debian13-dev, 26.0-jdk-dev, 26.0.2-jdk-debian-dev, 26.0.2-jdk-debian13-dev, 26.0.2-jdk-dev
sha256:a8c17f779e0c41d145987e6e5c321546305b40b0cadc6c1e3cf345ffd6997a14
Manifest digest:sha256:308965bbf0c63f718edb1430ac7111f8fa7f3ebde141c1957ebfdfd031d9106e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/sapmachine:26-jdk-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/sapmachine:26-jdk-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/sapmachine@sha256:0dbc0ad6de64198f12030e2bb74922c3735ecdaf48291aa554c83d9857914286 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/sapmachine@sha256:7c8ac78827e304d7ec973c8683bac181446f559a7abff0ecc31ac2c1f6685b66 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/sapmachine@sha256:db320d1933cd1585baa9b8f26b4714ccf69668fc4a80d08fcd6086801607888d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/sapmachine@sha256:31c2ce15006b30f867d59f09b7bdd30721475acf695d060360fc799526d9f2b0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/sapmachine@sha256:9572487f7bdb2845b60df3765d0b57d444563f8d6a81e354fd08566f5f646db7 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/sapmachine@sha256:0f38eae2ee7c29d8d5a094b08679c2a6072fd67875578d643637b165891aacc4 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/sapmachine@sha256:6009f9eb2419122a1c04f0b0ee7ae8dba8d2e240f010576581f62e4c59bac8ea |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/sapmachine@sha256:d999461b88ceb6d1aeaf8809b9851893ebaec691a429dfb2c13910ff64523b82 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/sapmachine@sha256:0c31ef9566e4a972be5c4265196991fa134b07a8cf24731c7883c83e1da40104 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/sapmachine@sha256:9d9498b54136b7ccc434c0f6f15c1acb2f45e38b483ed2c244fde173651b390c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/sapmachine@sha256:23978af708bfc30af1abd34d5455a03d11ff8a3e8e21825a6e0a898b854e255c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/sapmachine@sha256:03de5a6da62e3362f41797fcad0dfaed1b83441b70888f1cc7372056253b7f25 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/sapmachine@sha256:549b930eae4371ff65159e9e6ff6413717da3ce7e698ee6e77e31684b32da3c0 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/sapmachine@sha256:6449d30a0d5396ac8a72f48dca93a7fa89669fe81757b04e115c1c8cfa4bdf88 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/sapmachine@sha256:57a0bbdf5f4bf3d7609afa1d9080b108241f5207f6b9b67c92c54d51b7a7489f |