dhi.io/python
Python 3.10.x (fips, dev)
3.10-debian-fips-dev, 3.10-debian13-fips-dev, 3.10-fips-dev, 3.10.22-debian-fips-dev, 3.10.22-debian13-fips-dev, 3.10.22-fips-dev
sha256:dcc063b38323457ac0b086a695c56579367bb9491781fcf4dc55cd40e938cff8
Manifest digest:sha256:5f622023df5d6cd8ab4b8b5af9119b5449910107582a1bf76146bb7b31b8bfd0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:c2a937266df06c2d3c314cc720ee7d2fd6e704c621216fc61534cd4f5294c962 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:4f94a06e328b576015c2dbeb0efe94dbade32b685b276746977e676252a25539 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:7fc3a9bf49a079c6bb959d90ef07bd7d67ba91e373d594c510180363a7a44acb |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:568889e9cbdd7641369b32dbc17e4813a7080f74374f790617ade3020724a065 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:27ff4f5be1a436a2fa254a8bc4f167b3d51c7e70a5824ee11529b60761f1a888 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:ed95085cf37f1b7e522ffc91af1707f6e6dda049cdd0e97ef71468d9a9877996 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:b8fa6a0c5e4866a1079e72db7d1a52eee7b83ca7ee29979a6b4e996192611dce |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:f0051b7555c8a5afe763b8c74e08a92a8a3630254d74c62c3a6c17645c96f878 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:ffa296c12d5fde435810e96b858b86c797f603e7cc273c4b2c1b6eaa0fe8965e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:e1e1777fed12b6801c0d81654983008d9e1ad4c3246dd37c8e704ea6d47065d9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:be7170ea49c02a2096f224f374d31a314d8850fc247fa0ce4c4e41519fc428a7 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:1092308e7eb3b5abbc51873a012af183d60567b5166dfe3c007ca58654ee40ed |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:0c2361d3a665322f7ae66be1a4461543abc2540126057b9db5e4e803f15f8089 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:e0ca14360830f3561db3c2a40e48a5af4cd49b7b0ff8d1475c2f877a4f2a18c3 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:d98a9f78a35f7fc4fab3398d81dbb549aa5ae927a8210f19a19ddfbb227e2379 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:67b32eab7d0e2d90a146811a37fc2330789d44fe02280a698b6569cff030a5e4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:2010b60115967205564df9befc63ca83211b43dde3e2507ea3d97654fdcf8e4e |