dhi.io/python
Python 3.10.x (fips, dev)
3.10-debian-fips-dev, 3.10-debian13-fips-dev, 3.10-fips-dev, 3.10.22-debian-fips-dev, 3.10.22-debian13-fips-dev, 3.10.22-fips-dev
sha256:119ae2c32c94c1bdb35e432fea1895141c8e1243fbda7b779edabeebaa8753ae
Manifest digest:sha256:51e5eecd846e057d2ed88e4c17495a13320f0f97cbd0f0e96ae2a0486aa0e70c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:3b0bdd37b4acb50b0f7c713b4f19b2728cf83f2de067683b169b67d88c1285e2 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:ff5a5419a19c37f607c51744e0898f87ffc3e166c1baf80b5d37ddcaf23792fc |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:14d5ece41002d0c09cf8a954fb6a556f148ab3f6feca8864fb98121a3986e97f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:9143e465c98433ea6fd5e785d0dd2f29d313286122f928c9f22c9057f8aae43b |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:e3de30b8b7d65965a6650e8eaba752d85d0efe2104e3a56ddf6d280bafdfe67f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:5a833391030ba4406d9831bcf3e55018ab4672cdbfaf58f920c4e3c51242dc0f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:b98792f1f04684308f8fb05059705cbe2a3aab3c4e6fdb8b3441927601e7ca9f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:fc6c2ec8b07e0c1a2d9e7712e87adca218e043099de050e075372b3360789156 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:7cf809829e9dcc76ce282e21ef122cb4cafc3aa9f3b28b71afe20d507885e5be |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:b27be08235750818919a269c8ecc6eab14a92c4a85fd5218a48429bf6d039731 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:e5a6ab203ff96822c03ca4a925e740f04784dcf00dbde9ddbaedb27291260eb0 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:2fdc52d0c150190388bf619237bdf90312935d16e807ef9a7ec266898a5e90cd |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:fa65d47ad5b90eec4888636309794f12e34ffce8f399a258c252220eacd7a8fa |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:018e5951ee71a7f18a89ec219e3ed7672e2d4477a52805fea7a5c11291f10a80 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:169a125d580b339c6260c7287e2fbd35af0a8331ae20f76231b4485838efef98 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:9765f93b93da02a5a612e02b8bfb14f2f24bc6615bbc6655cb24fc6d7db29b95 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:e94068fb1903ac28c825fdfd277280db57eb1cd6442ffe51a70cb1a6d4e56a2a |