dhi.io/python
Python 3.10.x / Socket Firewall Enterprise (sfw-ent, dev)
3.10-alpine3.23-sfw-ent-dev, 3.10.22-alpine3.23-sfw-ent-dev
sha256:8025b59ecf55744cb6b681f7a3acd792559959e612588c86109b1f8299221ac8
Manifest digest:sha256:a303d56e6f12e1ce743d4ad9c3d64b7ade9b3616635a14d91783f4aa8378449f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-sfw-ent-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-sfw-ent-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:75d40ff78be5474b09d047e2b1db6d3af4319fdbf163b71b24da16cf8611700d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:81e1b79ec798d61071437577a3da3c3d2394d162a9a77e073b6e3879d7fe770a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:0973d19cb4ea71ffdf8843d80b0a8ef443d7acc1ddd618526e9622b5ee63e932 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:fd88d44cdfe69367681d254889dd7026f4de5447593b95f58202d969c8f2a5a4 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:45bd2ca8a9723b14da6ca6d914173aa80c62a73a50f1f95a82a3c45897a6da50 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:c67c98090f1c70a294794fada321f72eef3d058757a190cbb0839c9430bbc366 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:f1c0565c14daace39f48ba74e2abacfefcf2c3577dfcaa793bf0db14c6fb7e91 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:351a11b59b6a5f454c42057df7ee3da3088a03c1f53a2f910cc6d694a68a2e0c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:c83e9f5a2c43713e33d774af6b1326536e9cdaa43a325a5b7fa2ca49b2cc2152 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:95ad9800dd0c3822becda2b2c15d4e84c6ed218a16a7bcee4d39164cf30120d1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:4234a3ea4da589f4580c8e0293aafca06839efc9e1749ea006aa05030a6e0d27 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:82084859e935d8bbc13c06748009ac94d6de5283a9bfb1ccf41d03d1590ad224 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:7745939a76936286afcdf8b07230945ed07570f29a8b393891da2f6ed88d4ec9 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:87bb570f3bbda7faa6d1522c264c4fbd8df6b6bf42daa78aeaf0254f790985a9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:f420232f57069a564256bf2a1bacbb9d0bbcdfe654754ce37f989ad2b334e41d |