dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python, fips)
4.0-debian-python-fips, 4.0-debian13-python-fips, 4.0-python-fips, 4.0.4-debian-python-fips, 4.0.4-debian13-python-fips, 4.0.4-python-fips
sha256:eaf5dd1cd7f99fcfc227a0ba9fe5bee3438e2b51dfb03428d3357e8b4fefd5b4
Manifest digest:sha256:59b5cd8f192016859e97896cf497ff5ca213845bec2a6a00785f8da64f599b42
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:73bc8e1c45e22bd876fd068ff9857e687fdbb7b7f8c8a6efb2a8933b00b6ec8d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:b1dfeeb3abf09aae3ce167495eb36e2bae2ff9dbe5cc19df4119517aa8247cda |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/spark@sha256:f7a3d87df2d8a4a6a6389b648c21fabab6e8717f860db9c7429da0f48c2aec9c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:be52b80a54daa03f81ee075ce3fa752708c7b1938a7f39285e835146efd02ea4 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/spark@sha256:ee1982fd8f93396ce797291d1727ad701ac4b9565d1ef09fd43de6e9a5f70f00 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:c47075b86430f25c0122e0a6965dc5ff75227b87321585c0dfde43139d8581b9 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:b3a8f02eb615411d37de54001bd959c0288ead06d13a5eb0a592fd2f269ee532 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:d42cb6d2c1453b10e9f399eccfb2fa6e501377fb9b9c914b8df6c60983213b9b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:2259ac79ba37e9d5359137663310f3a0af364a32e0961e2f4435e3faf61a5035 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:030a57d6bfbf59db0cc71309fa03fd2581202b02cbc2f5b1b9658c34bc4c7a6d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:4188ec17513a4ff5df0c0bec79af8c128ced06c01ad7506281b10c489a487d9c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:065c2478a1b52c352f6004eb82446973c9d320dbdf4b28a973364cb354e66c6f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:f9651b2c0167f6bd090930066070b992eb210a747d3f6973d089b2432d710208 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:3833d0a82d20962baeccd8f6ac684679524d2cf27408f972a88183a8cc8cf6f6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:f1e90407c388f9d1b5a9dbc1a9a7c7d413798d2ef303bef336725024182b0dbc |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:b13b531f31c552a7d6f148840f0b14a12ad0a15bc0f066b8074f31008139bead |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:bc7cfc2c7513cb459faac99c0a9720584d9239bfa4ccb70b2b26e7b05933c7d8 |