dhi.io/dotnet
.NET 9.x SDK
9-sdk, 9-sdk-debian, 9-sdk-debian13, 9.0-sdk, 9.0-sdk-debian, 9.0-sdk-debian13, 9.0.319-sdk, 9.0.319-sdk-debian, 9.0.319-sdk-debian13
sha256:4983a54bc2d65968f89d233910d6014b733fd9ca716f4bb484ad426c671e6da6
Manifest digest:sha256:f2f872dc707a32a34be9c1d996e6001ec5e0471d93207f01c26fbfacd7258cdf
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/dotnet:9-sdk2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/dotnet:9-sdk --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/dotnet@sha256:b8a3e8a58b1104ffa1803d9630ae06697f4e6199961a030247a2ffa27cb68d09 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/dotnet@sha256:2120c987a7e15b00ef8b231e8dc0390325d10b6a9409323f38f39ac71a4917be |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/dotnet@sha256:8d06d71e209ca99bb7d138679668bd316f0031c63f2cfcf6c208a09a4f365b80 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/dotnet@sha256:c85c0ed59575a5a38bf05cd2fd6544c099fd0a30b74106981e11aed144351ba3 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/dotnet@sha256:76eb32a5f42c4fdbc1b8678ab5089d39ebf5ee8de5da2c7ef61fafcf30a1271b |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/dotnet@sha256:e5237f5f9ce15a0e9b3da8ce2817aec855027b2752f54f04c2dd57be2a3b1375 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/dotnet@sha256:53aecf844357de99941b55a87b3b41111520c9761bb2d575ff20ea52748aef42 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/dotnet@sha256:24d0e2d70137b273ae03cb547050e30b9d11c04f0641bdfd98a5660a9030cd21 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/dotnet@sha256:5c3fa62394771a88e4319617a9c468cbb445791a139188975adac22c2e0ed7c3 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/dotnet@sha256:ecbc3d37e4ab60d931fa361e2592287f516cc50f0e6c437f912ab11df24ba1a5 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/dotnet@sha256:6604f4a35b64c0f9fa7f42a37c22cd6b80a34f5b1a68723d9ee11941b3fbeb57 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/dotnet@sha256:63a7d509ae5ccbfeaf12d4a2bceb147e5643e6c95aa7568bce45f76128e30125 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/dotnet@sha256:af4af4109d3c1912aca53b94a20b61f4c03b0f7373140b0d43446bbf1a26cb86 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/dotnet@sha256:590006560fa094c6a113123a7d9d728b1f92d485010a4b4171430907d9338085 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/dotnet@sha256:fd6358a8f82c4244a5b307eb370af5035c7abf1ebb4938f8791d94906e9bb14b |