dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.22-alpine-sfw-dev, 3.10.22-alpine3.24-sfw-dev
sha256:301d681021f8d7381c6e53516f60defdad7c8a3732f6ab3534c46eb2888268b4
Manifest digest:sha256:41e989f5cfe1197bdf7c74d1bbe9c268d024c8c492f3d4de35b1a51c833ff02b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:3110a1abc8ccedfc52a6682a290ea776bbd53337dd11831f174c219c925c2a20 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:6b6b42a22db35344dc602205533fbbca698ac538a8d90cdbbd5988ae375fe1da |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:abe45f265a82eae062d17061886d1e61da7f8b62a487154ccc2db450eb55a50d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:ecfac58b1e3e8bc00c9d11549d04c59242b181424c72a5871571c26b8da29983 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:79e3eb3f32042fdbe446c575bc362ff92322a6c4d53e406908849e1f60c18a35 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:771aa5e95deaa5ec20636d98ab6e930e1508615522488fa42968fd614d2bb1e5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:d42d1bcc834cb558710838499ac2ea84f34c937d7a0c12cc534c9d4c6222ae51 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:06e6eb0ff4ba3a35bfc54ca5ecb107755d3425b6fe3c969d6c1f1e012a44d67b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:02411595849beab0b37d240b661cc468a9196257fb958cd51ea277b280005389 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:634d92d61e8e21f5d0a919f0c0577162db46210b18983af0edf78ebe935b1dc0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:2560c8301f2a5fcd0cfd60ce290dfb5ee8350f15e5b90ddee271fa750c38c291 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:bbd9fda23467bf21d57ec490fbd647e565559e342a3f44644471ee39a59551c1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:59d6dd112657caf750f4e2e8698eca6b86853d5737b05b935d86da82014839d5 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:5aa9a62bbb4ffe1ad109df699ac252e7e710d58454fd132cc3f5644efc594201 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:acfc2cbd1e0dbd0d0028941bd02bfb9d9696aab15dd35778833c1dc8645aee28 |