dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python, fips)
4.0-debian-python-fips, 4.0-debian13-python-fips, 4.0-python-fips, 4.0.5-debian-python-fips, 4.0.5-debian13-python-fips, 4.0.5-python-fips
sha256:793088c29f5b76365aef5a553a3f07e05637031ea84aa77dc2aba265d036d086
Manifest digest:sha256:889da10d716fb085217d07dab87c89674ce1abbee618133bf04d5b11915f7caf
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:c702a1fc37c0e76479ef7ad93a3e1a0a0ba831200c2310deb280f5354779216d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:3cfdbdf0f23ea38f1b2d348ef45b169c6876d5022dd8e7c5be3c2f53f852f4c3 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/spark@sha256:3dee9266100627577e4bd61aff02e0f4d099f51627ca652cf45c3e2f6dbe3d66 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:f59614b78b1a6e46644a729e115c38e690f6da6b09d17be487690ffae6d3ee5b |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/spark@sha256:9f0304d57342451950169538a354d4bf9a876712c4eb68152259c007274f15df |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:3781c64dc92a89f7ebb6f61d506a1a79413a718a522247143e52e2ea17341eb7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:1d41b9159b00d2cb02808f1ace6ecd11df680684c30558385c6b5bae739778da |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:bf6b9005081cd2293419eefb2aa4d6cda509e04a1f4637dca923430b9411f28b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:4c15e09c84fb76b8e839adb73784c3bc9defdae7e9570b6030b0b6c7140d13a2 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:60a60a4144463e032999939ce18f9edeb0a6a51e8bd38062ca29a07773f8ed36 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:336b59ebe5cdd9bbd69de265a7bcabc74d372a6b0bfb487ac557f6ea3a8ad2ca |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:ee9ac8c3f2c4c0da087d25ef922a5765d0a05c81001666a6ce3cedbf55022ee6 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:07100553f20460f7dd5eb38cb9ad063c8e4933213e9360c68a014478ebf3dca3 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:b2a59c2ecdf1435d07ed8ab9193b0bd98c7dbbd791f697189cf476f444456540 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:d12d2238815222441599eb86230753e5891505245bf600babd9d61580f544ab8 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:9221396a6cbd12e97d8834a0fee0b3ced3c42eb5de89987772b7fbdadd08891c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:ba867b9e8afe19e18eaf25b96f536d62d494c34076213e34702df9158a5d984a |