dhi.io/python
Python 3.10.x (fips, dev)
3.10-alpine3.23-fips-dev, 3.10.22-alpine3.23-fips-dev
sha256:13a6479dfccc03e27b5efa0d41acffbd05eece88e02c5e5164fc2dbc8b4c0f63
Manifest digest:sha256:eef37d47b75b0608946eab05f623e19169b7858ec8bdbc25051bdba1e3cf5386
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:6eda7a6f176432a415dc097c37cd23619ad6e416e12ba6cf07cc71cc89aadbba |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:b15eae31643b1ece2617391a3abbf6021f9ac474b3dec576d570b4bf878fd462 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:1e6278985f7d5cf1fccfea0d97ee2ae6d8b90db0b12dd917fce8f56d3450a520 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:afdb07168e165a1f325f80dfb90c2e590b47a66b0a2c7684154a70943069b939 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:3b10be8227652cf3d8974b1b4ad8485f44a1948db3864203f5db6d49922272c6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:9b3dc7bf1aa69446c1bf5b48b53577077e587d14ff29460308f06dcb8542ca71 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:9c3b80e8be49f635fe0194cbf1ab2af7d3ee261e7da30464b5b6d11eb0ff2a16 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:f28cd610dbbfdd73ae379606d8b7e7fd22688213cd356516a8abc4972bf974f8 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:0530d523d5fea82b512de9581056925da7309cbd1545b0f3cc332ffcfd1a9ecf |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:aa051e7338d3a5e899e8d2e0aba5588242ef375f51a200e5ae9fceef0530c2e6 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:d4839834f5d3a106f86332181285bc8e3ef6bf28249b4ce97311b94d3f6aa5d9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:8e8130080b971a58b6b98a041c2c028eaf686be06b4dd8fca0b933fc149fd9b3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:01c108e5e1a8cca1659f764eb9d95d3c8fd39269b1deff9a860add3389a37465 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:152fc2c39822bba4dc45a8632f0e84b01491adc8291f8cfe6fa200f4f648b000 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:43c34a2e26bf6b3ee48970c5d1eab5b5b7ed8f25363c7179a43a94d3ee8aba57 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:db52f6b334779ef976463c15f818e4924b2ea5fee6a09dd51c4c2ae1cd58a23f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:239a4c2b35f51adab2eba5522b28bad82b4648f4761e85172eddc466bcf83a48 |