dhi.io/python
Python 3.10.x (fips, dev)
3.10-alpine3.23-fips-dev, 3.10.22-alpine3.23-fips-dev
sha256:6e49a9de48d883c89c2c617ad980cb43e235ae7da454d2a5a8ffc07251dff49d
Manifest digest:sha256:501fbc4d3d62f399f9749d311692cc886813b16268fc0a7c483bc67bb623fe12
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:29bb8cf86fd3b9b694267cf57205de8687729303fb533fceabf9b6a938112b47 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:1846e4e9026b5564c1a2b95113983817d76ca4cc2d161c5f4870acb869a1c624 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:716d7fb1f9a143b1afe9fba3c8bc355151793bed483444e25c584cbf274a1212 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:331d1807f2bde0ccc8dc2d4643c8892f2de1417e350eee0bff1c34207ea95167 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:72023c6d0b87d02b0d1641ed11b5451e3e6cadafcaa2c5e71f36efd71ea25ba0 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:7b301d486c3f7184257bc9757f0bce86ce9e5c3b08c124e7ec092eb600c4ace1 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:4804a078b80ccca7b9d7667caf0b3b6098dce1253d655965ccf59df1382aab40 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:98360c1609e8da93462e9fb7660b607dfc37ac51c04dd2fe63a3c299566805d2 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:9860bd085a5ab9c058d184dc333cd7483e9c2d29157d625cb9ce95dcd2d434a2 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:9890167a3ef873611b7f86323913d7e5f29b8fcab5d9ff4402f1b640f234abc0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:44a5644cffa60b1d497ddc2a379c992de265be02e51d0e2f93ccfbee4e715fed |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:7882e270a8e8291b5450c44a0cbcebb9a7f085e0fcb37d9e377730f2c72f6083 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:d825789df8392dcca725e9c9f3192f1b64d5c0e14df0f052692f59e8520dfbdf |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:7be744776f8207a3de8e8750afd3ff9f25b089e7a4d6569cf6a954dbc8c483d6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:ecc489427bffad8d84e1cbe9a49e639583e8fa431ee1647af9265293085b55f3 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:50dbe2bb42c1519fd9a86e6163e8fd3156696fffb8cf5824b0a5aa222fbc285e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:fd4252153df24c0c7f1858a81ecff1414c5a90cbfe86bf23f21dfc6b1c9f15ea |