dhi.io/spark
Spark 4.0.x (Scala 2.13.x, Java 21.x)
4.0, 4.0-debian, 4.0-debian13, 4.0.5, 4.0.5-debian, 4.0.5-debian13
sha256:22f08bc25b1f8e5d8a86940f8ffbe8b6bbed2946a06b51dcd8b04af830ea4776
Manifest digest:sha256:e4507eec67574ea4802ae5e82d6b0aedd9f845f169058cb3088d095b81722f59
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/spark:4.02. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/spark:4.0 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/spark@sha256:cf522a5b477fc705ed65be3839de3977b26882158866a0c58bbbc099e29e9b8d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/spark@sha256:c0e792ebfa0301f579264f8271f8264c199f7ca299d2995341be943e4c170973 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/spark@sha256:9ae470f5adee8f89b367717035017baeb60feaea7655eb2c612ebede9700f429 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/spark@sha256:28e8b200286e3ba216e059870f0c7cffecd3e812e4eda2230b2cf731b0811330 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/spark@sha256:d4aee070d8ef64a8521515d9c8fa7d51c6bef01c741abfff3675d25846ef5750 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/spark@sha256:723ce98821cca35124485ae47b9d1a4bf94d7b120114458d7d75650a034ff3d4 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/spark@sha256:c1dd12baa71267b556036758bbf5d4861186381483dd98ffb1023f25efa6efc4 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/spark@sha256:f657869a0f24c34966754907af15778c0eda602c9b7f2cfa7c5f2d08e3494cdb |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/spark@sha256:57fd39bc78d8cfc561b8eb10236f57adfb3deda9db21b3a63de676c9e1ae7ba4 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/spark@sha256:ce62667c550d38d4011f9c21ec9b11f609134973e6ba0b8a19e43bd46c1c77c0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/spark@sha256:99a6e0fe5136b30fd652df5a86b1383e96ef38258ea216fb17acc3fb41c8fa43 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/spark@sha256:dd9e9d004d888da7dc0c43616ebddb22fc05f910baa4390d9a441595870cab6b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/spark@sha256:6b8a14978fbc7bcf31b2c735e1b0b9bfca6e24ee076b1b087217cb22bdb66f38 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/spark@sha256:7ada6e07a03370fa000863461b4f689e15c6c076d26f49679fd58ec7b7970244 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/spark@sha256:a57c2fb93982d6f213d09c612d09a4ebb8ffd0a829dabb3ad2c721e3efb1cc6e |