dhi.io/dotnet
.NET 9.x SDK
9-sdk, 9-sdk-debian, 9-sdk-debian13, 9.0-sdk, 9.0-sdk-debian, 9.0-sdk-debian13, 9.0.319-sdk, 9.0.319-sdk-debian, 9.0.319-sdk-debian13
sha256:fa8c8fbb7a5b1991f2340c0447bce86754bffea88a941122e672e1db79657c95
Manifest digest:sha256:a3c0fb6719bce22272cfe4506ebe9510c94d7acbca870613d279b238ba33b97e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-sdk2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-sdk --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:add2194d46ce9b33b1d5a23414c2cb94f5168789a5b85b3e102250ee710db02e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:a854c312f9dd2449ff5e64e43779356c9fcb67f3fca0524e6f2075c8cea42d63 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:56b7b5f93c6b484d19b350f5fee7854b49ed622138a14fdcc9e600b31553edd4 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:fc70ddb79ea6a4632aa8fc0232e7629dc0f572520b07db3d36e77dcdfd00923d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:644248786b0f157a94e1ff8dba93c7127cbdb4aaf506fb6efdfb1f64fee64b53 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:fc12613c5d9a3ad6c0443c778c18b9cd64a334d136ec4c64ec1d49c9e08e8320 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:1874de26875259f102238f365a17d9ddb8efb926fbd6ad1b48dadb0a1cd55323 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:bf1f0096d0b204669d29a3ee91e6a43aff5610c8e9ca937813327dc5235a76e0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:ca1f68de88c16f9a35c1ea77b8ea5b183e9085017fb109f4fb0cc17760cb5dbb |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:976353bd583ba112a4e9b5829353623ab93363e86ae8aae5fd10b5a62b0319cb |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:4bb3aee97dcc00d303888263b0394c095436b4667b9e20ddbb50b4dfe9575f7e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:a6ad4ac4346410e709cc8efb39733630adc0737f94c6514b365dfd3f529b2c73 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:e1471ad13e29b08119c2259479cae14a6601808b6969086f65274d880d66cfb8 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:457be1c7a6b3062a95b3f17a5496db8d88b069fb6891cd3bea287c9a85bacaaa |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:779919a0ca838fdae927b0eb5d5554611709500dac4ba643c1188a8d8c7ce07e |