dhi.io/python
Python 3.10.x (fips, dev)
3.10-alpine3.23-fips-dev, 3.10.22-alpine3.23-fips-dev
sha256:9d8c42ef022de24ee727ec389170d66353336c9bb32bc1a3b2d5fbd81c8c6fa5
Manifest digest:sha256:d470fa38ea251de12698ece294ff9bf761cbda66c392f25d6d65a924e21780f6
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:00c01893e9d93dad354ed460eca766f0f8ea64530a13b79190620ef4595cefab |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:ecd43f54985c4953ab228d6de0a1c1ab9466615a2f1e712d2e99fa7d2145a005 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:5cdc111a76ce87813ba47a39d695212995480dc358ff17ad35db727f32beb9ad |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:b1c495f348a7ca573b49e85a9ee4b45292a4affefc31602cda0af2a88cafed90 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:03070e1755d257bfa48e0c7f90511072f96e4399abd5cf7e4c5f2d8d0827b364 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:a648d2b0304ce816699ce3e9995193232335d9cc18beeb1e20953c53725eebf7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:d1c54ddc9a14b645e07b02194b5c13fd10f5d226638186770cfdc09eb3e4eb8c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:796e0f4eb930ca2cbcc91c416f83aa193cdbd58b9ab125a02022aa19b2f5eeda |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:1f0216c4328ccf27a7c18111d2e389446eea718d41c3a76028f33f4135f14ef2 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:2001197389125d41e986e2e3fb905c7e94d89769cad6653a94678bd1bd2651d6 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:295f9994a5f985f2a853c4757526c18876e22b23ba8c8bd805ab818cc732c4bd |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:b01e37f84e9ea6d3fe3d884aa22db55c679dab7044ecedc8bd6c1ee782f14790 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:a629f54f320a0d279c680cb986ca5cad0229449f13125e1c075e1be60a9aa21e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:a9b800ff9f60331092f7455a45c987d3da3b844b6a7fe56216397cc4ea359b8b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:0e2870f1fba7dfbe9118d5a09bce417d6ce438c6249b3beecf5fa5c75cdf61f8 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:890ea48154816cc2c06a7b70732abfc1e015344f4300ebf33e417d62e1b865bc |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:e72c165e391a0bab6014c5a675fa8a6a2328ca8aadf7a273a1451b17758d063f |