dhi.io/dotnet
.NET 9.x SDK
9-sdk, 9-sdk-debian, 9-sdk-debian13, 9.0-sdk, 9.0-sdk-debian, 9.0-sdk-debian13, 9.0.318-sdk, 9.0.318-sdk-debian, 9.0.318-sdk-debian13
sha256:e11713b83024a89b4ac94add0230f09b9cd2b5edcb01204fd5008284fb8abf7c
Manifest digest:sha256:87134173465b3dc1a778b488121b57f1b68945e98917a5181abb930e22c15d60
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-sdk2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-sdk --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:9c18f271182c5b40d57ac257d0621ebd81526f499c3781befef5ec5a147f43d3 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:8ff95ade8f4c91e80cf8a8d0ee4fd121698c7b6cfd66277dc4649195ba8f0879 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:c65065505d8070228193b8244dbd0cb30bcca55ee2b959c340a5d157c92af1be |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:658a54202c4a53d43523f2031a10f4f23734e33155e2d82f042f3394b202331a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:12cf3d8e8c7b049d7772d3ca76398e5bc89065ef4ca279adbbc62cf1583a1bc5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:c4a2e1a4f433500ced5b6774350c4fcccfb8bacf70b71685b035e91e6a029eb5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:c26448d42d039a741364e07fac144d0b0e6a97f909600061286e38c255846d8b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:81983f1b7bc3dbcb211b7293495699c136d1006ea20457be3000e97db78c03e0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:5f9f2aa90dc47223a0e4983f7aa188db8bc4823758da4eb32964d9e389752516 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:fc10bb080974deec04ccbfad152c7cfdc31ca333492ecdac75343a555b548ea3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:7d70345bac970da595f0527c4d5ca0d903212219e855ffb5d460238b6183d9d5 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:d6fa702baf72d477a126617d6c5def825e6a989c2f426ccf65735b0b2739a14a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:a5909f7c662ed8d22ff6f686e6816676a9421a225ab64b021ca22194614a8ea2 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:a81afa976dbd3d1c6e2ce42281b796f0fe83c7931a913e17c2d0ec7783508fc3 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:3415fb12109c732b198cc0ea452254e7d9b5e13a15a13786a7e837f11decb40a |