dhi.io/python
Python 3.10.x (dev)
3.10-alpine-dev, 3.10-alpine3.24-dev, 3.10.22-alpine-dev, 3.10.22-alpine3.24-dev
sha256:76d357aa2685bf3bc46ab7943f587eb1e88c61f1a63f53487c8fcfcbf7a4165d
Manifest digest:sha256:7648e9fc2fce28e3d640f35f6be147f8a995d1e625fcbf486df4bc52861e6861
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:0a296010a89fc06f29047f6d26785e046150753f2e639dc4e81134be99bedfc6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:2259e8f2674e6a93eb88302579c6926b64e8406337d239a2351a3ba6ef8adef2 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:5c913ec5cf013fad34599fd7026ad8a0e0934f258b3cfe5ac799db7a12ae6908 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:e7bd468a8a49aec6357e63ddbc731e5acb89b2d07cdba6c492656f76a10c088d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:1dc95235ca0b98ea225e12f748a9bc71bdee0c6fdac68c1a62941e8d5ab948ee |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:7c10c56cc89d23a52cda03ab029d9b8d624cf7dca3ce497c0f2fe022c4dd0ab6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:d72c4f121f3acf8001e261ddfc7ffcbb79b0649ff89ef83744af76dfa29fbcaa |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:aba19084bd81fe0304b46ee47b0c8cf973976b7deb2ace07dfe4401ab5720e3a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:102bc31bf7dd03e6b4b47a93777afd2e861f1fec04eec7c2205d733c0f28cd0f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:c15af5d3264e927797af80752714624223f253b2c2af16be2ef8cd7c89f3dd2f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:78214cc6651617d4c13ce0509acb6e1a23ebe903af66ef12bc9a2793d0ea25ab |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:7fc88a23ed97a11fd13538e313e8c40feab536ce97365cb6ea9054972fee1570 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:dc11f894a542ac1df10f2a8314b9261aad0dbc85673a68c88262eaf1bcc027d1 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:b3ab0b802d4185598fc152334bd342188f8a311aaed46bd0e0391e6d093a3c16 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:ebfede3d0f1fc3799acb51ea593eeac682c49cdd0ce387765454723f0cc23c6e |