dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.22-alpine-sfw-dev, 3.10.22-alpine3.24-sfw-dev
sha256:1db692131d9b0afab6c411c44dd704f89dd6c110421e8c7184de2f75640e1ddd
Manifest digest:sha256:e066092d19c75bdb0ad8c907ba86f44601e3260ad9bc738d75c96dbb42dd2a50
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:132aa27ca5550ac366441d54ed732d09935b4fbac93679292a030ac652c0573a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:7c9081ef9867ec5effcfd35481c29d966da17c59f92e817a86f3dad2225585e3 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:27d54f2cdd1dc6ddf99df0545c7d5e4c31e9621e26ca2658ce67af7bedb94ffa |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:9fb6ad89814348595fb320ebfa50a7c81dc72fcf4ba8c946dcf9e298f498edba |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:f7824e6101b2fae5eed59c24c3428979bfe096b02e1e7f88cebbf7b60a17bd08 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:14200f533e830a1ae63b2275e8e4a905a6b5e3eb7ade973325aa62d205122d90 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:2988ab01c53eec2901244b60532a1879e3510ab2407dcbe5762b2b0b5cec03c1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:e4b8a2b5dd2b1bf4f9321f52b0f6d16460abb06e466dd55df48e2e53e4dd2cb7 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:2d9d655015befcdd76617b617b26100727768403d2bac231e248f5f3f3180ade |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:23d4462ac4a2de4194ca4dd3c5deed76b2c8391f280de398f04c05f377fb6a49 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:cf8b5b0a361d063b14db883bf9cf7e12722e4cad6cc6db3a3b3ed5c459d9074c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:156cf402f9b608dfe103fd3232628626f10e2bcc462d3f5a503a648c92138ba4 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:19f4f5a0b9c0cac9ff62773c11f3212c762ff233c5ba4258d266ef673201f480 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:ca799c68e5c9d5dbeb06ea5efc495c7ee3c424917bb96e4cdce66a710dc4a4b5 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:a02b0ab33e9efd4799ccf5138486a963d60c4298aba09f1cb6e0d45ece1a274c |