dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-debian-sfw-dev, 3.10-debian13-sfw-dev, 3.10-sfw-dev, 3.10.22-debian-sfw-dev, 3.10.22-debian13-sfw-dev, 3.10.22-sfw-dev
sha256:55bb65a9695d72786a4af59c789d8cbd99c6cbe123fdb3859fb3d1b42b8d0cd8
Manifest digest:sha256:09d800c4ed3f804bd83b0647b5ac09f875430dfe1d0a2262f4ed49c762cf868f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:9d449671d733aa458f7c8a96d202f487b871b1e30e4e0ff5778b5f028d92d5b0 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:e20b4ad73b61b9a1bc735babdef9311bc488ec60a747a310d83bbaf1daea157a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:2c05361df97ab18d85e4f7cd19a9a125a7f6863a799c48e261a95c8221189839 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:05f1ce4b58656ae3c776f3fda21258fef3e8a36a9799ed4f511df8184445bd27 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:106aef877c854b4c7cf63117d1fa065507d03f63cd733cd04e95f79d27352007 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:4ac14032573184744c7a6fa8ceb0842c439d67e859bde50157ba9b8c8123bb49 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:641169277a2cf7492d2972c4ec26e30d30b3618ee33048756454177029da87ad |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:e06e28f70d35c4f8c1e7d10247eeb32a9468ba78daa5a94b579c0e2df12c5318 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:df80cb498f759d5a94930561e293cf5f203e93f91dc97e92b5bfe6ee976df56d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:2a138edacc257884481cbea5058fe3d63f4b6797f897d1396dcce112fd5bcd70 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:41542d03255271bc22bce4d4e7a63cc3e5a29bbc68477e1c9cb5153613fb5c73 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:e40083c09874611c99f0851b829bae88ad4e10fc5492d5632855def48d323f09 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:65d9f63fa9b539a9fcab71f5fc4c2fd23fed4e0f651166d0b9ade2b76c026c32 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:b74ab8abcea5fb3b0d89f6e3b4815404164d7cc7eeda82782c3aa7a053ebd441 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:063b00f6e134ec1ac1cd3f1403ef9f9618bf904de2390debf4cb50a8f46beb66 |