dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x, Python 3.13.x) (python)
4.0-debian-python, 4.0-debian13-python, 4.0-python, 4.0.5-debian-python, 4.0.5-debian13-python, 4.0.5-python
sha256:0ca92b5e4dc47445772eddf7a902dead99bc086e8b86bb5c88525ab20423e389
Manifest digest:sha256:ae8fe3bb72f7b7449c67b2e95cf03b60b73bdc9db0fa7151f7b051cbf4a66491
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.0-debian-python2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0-debian-python --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:7d2ebc7e8b0f43d50d589205490aeff104f7186687c1442f894a76108a530365 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:f6bfb5e188ed049f1b1d15b22523ebdffc538d2bd4e245a00a207e9766bf9652 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:8da44af1826ed88c321769a7527453f258caa732af1efae4ba41227a16bba1d1 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:a7503bd4783caa2698cd624ed5b4873ed06c5ef7ff92729ce2938b3b06819b13 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:92ac40a1711eddd035f48cd5e5f7c7a49e4a0dab203067355b2bde2903f38734 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:31053de7697b19b0875ae0d7b913743f6cc586c81e5a7ab118f6a7131351e60f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:154cc4dbf358a861f64dccadf4209f33bf45701cd81df8a15e5b51230f6ca23a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:8eb9899ef1009b666046d6640d44a770437ea1fc1fd5c1d5c4327cd3aed01c05 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:3b78bf23c7b5695b78622d083ccfb0c6d3310203e20d8ea6aad2798fe38c1517 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:58cd7e99734696fa9d2d2a309711c141ba9e8fd99f170a1c8c6ac67fbe8e2009 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:db276b69dac98a020585884b80036a3a8e220cfcdc300d5fc717bf0df1d730c7 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:113097459d6ec1b1bfba51fa3ff7c4a6961728324bcb03006fc66ca7d496f9dc |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:75dd4750967ba26ad19ae6f900ec10f8133ebef1995a4bcdc9c6a9aeb38b8c63 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:c0daaa104b81be3f19a88fc19831f2b8e30d68989e49949dc358e6da2bf3b4c4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:4deed86e1b2cf35248627c2b8557d21587062e7546c8bb74acb4b1bcc1bb7e1e |