dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.22-alpine-sfw-dev, 3.10.22-alpine3.24-sfw-dev
sha256:82af463351bb31bdcfd96126e430ca27a05888992b8741b55627cef24093852c
Manifest digest:sha256:4cca92ed24888387c60d43474fcb24ebce5fe8f0dcecae10de08af55e7360e77
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:90f6a65e7ee19048edc81f725dc55655c2bd90c1e7521ba3cbd6da79a6141562 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:83838ee1f1b8a426e57b232189d8e7f10d642c535c8656326c0b22b20918e4d4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:97db9e4444746f68554791b7f1bb29cf6e4d62c3d4148ba43a6a56824323aade |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:7c380e429bd9f1c136ea9d762ea5233d4c08a42a026437a79d7957435fbcedc1 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:0ff4d5c3e76b9b1144e6da90da334ff0ab735c9ede35a760c537e9498fe5152d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:156cc74c3662b2548f00c5466f0379568d2dc9a51aef8de8870cfe3a202826a4 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:d743b81f31914c557d55b221a66af9b66ea8292493691fe993a5aa176eb94418 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:054c488c415bc9d875d3a17aa18b99dc3cbacbaa6ac1ad1586bb60356360d06f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:473b5c9973323947588fed5fa583253245d278993f5b8d611e75f94eae5a5647 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:fef946e4da206ad8bfda8cb9e2368a394eabf2ceb27b1a9ca54129e8bf53291c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:c99504c6e9e0c37e9756a1d8df6f4e00ebaf717d487ca556935b6898cb6059cc |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:c2a2bdadddf5ad4b783127884c58a9e04308022f0594b4784b5c50c1e3905409 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:288955b691eeff964413e12961a02e3b23812d583cf49c4041903bee4d2095aa |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:f8cf27b25ec05bb51a47a85ba8cdb98172339b1831a2fe94c782a31e7de27dd1 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:ca6bc95262cad124bd737b9732cc5c9ab4a875bca150f15819613e9246ef4d18 |