dhi.io/python
Python 3.10.x (fips, dev)
3.10-alpine3.23-fips-dev, 3.10.22-alpine3.23-fips-dev
sha256:64ffcd57271a9decf2b9526649b236df7e10b7e6c2b4f992497daaee956840c4
Manifest digest:sha256:211e099b42e2ab9c2282d536ee16a11d9d1121f75a280284116c39ddbe1d789f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:7c76d1a2400b781295f9f9451e8654eac0f536df8e55761acb9f9feac52fa4ff |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:673f24a5c2359b2404bb7d9ab775bedf563c83c970c253c6b0481796e76d2f26 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:903230c65090175aedfd50841f0a412bed4888f99997d12221c6bae0d8297403 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:f5ede9ce5aa7fed671ce7b19569482c2a04d1600bef696be6af7b82c05903c87 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:652587ea46cd35ce862b03c18b8880fed9d0289cd014f0a1c5ff4e5a1628d5c1 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:16a222da9b4ec41ab20869840dbcaee6a33fe35690b71ddf65e2b50e8cdbadd6 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:22949f5769436d72619cb24c76eed287bd570c928d1d74f8e1d39e1d8b9a83dd |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:96dfc13c35cb8e1e1b2a71dc53ace4fe1ad8cfe4e0f20bae54908048dc0c8bf1 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:0aa2a5cd00e9f6085577365a3277f55bf0d9241a37e89a56b1884f5be6705b94 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:b1b82cf71e259314764fbf4b5ab60c6d1afb3ce50c7912d396dc6b0df67f5ad7 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:4b44ba120504a27134599a50f4b9b5901608db34a9dbbe9a0adfb5692f50d4f2 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:e1576ae4d5a5072311f9c504106cadaecf25dd656f200eb799b5b7930ce14981 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:a70f26987c7996e3c89116e752731deaefe87059d13a6d05c5b0e456f305600e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:37daad35a9b0cd93c3e9f0b5e90c142360ea5cc6cfc443ee480a7803f5ea1789 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:c33bd25f92c774b25bafdd38141788ca91c640524cb0a8a4f7f1a898f81c5ddf |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:50a14ea553476e708e64345cb357e75b0e647df0cca12c07195723c9badb2b3b |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:521b06f5e05002490973fb876e940e50398ced4b8f2f92bc74b864b98eb780e1 |