dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine3.23-sfw-dev, 3.10.22-alpine3.23-sfw-dev
sha256:36893651bb06d20fa259c1fc817e9761d4be31b68a87893b6c95d146357871d1
Manifest digest:sha256:bd77f4c4488c88a0498d24612e9e4f7095479e0fa1e5d0a20c618b42b9c1c9e7
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:6698aa1748f9ea3977144239da52483433ab3c39af881adca8937a5babf1698f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:279a01e344b550c2b05e71b24955bb866f307945f7ef486f787a6500120ec33f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:bdd329baf9ceb947b8c19245c7b3a5cfec035e4b2c4bc2ce0fe1bec51c1053b2 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:904c61228e80aac5691ba6e6b3b4d3976a0af88f93bc92f024941ff9992d75af |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:2380d33b0df256033c72df3411c8896ca57b8b801e80c5a6822cfe969ab1d325 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:8f3502155c7f6a304935c63701e36b5e9beec42c969d90e6aebd73bd08c13f6a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:a7beaa5a24ed7baddfca9b0dfe507414591c1c6f72c4c57e56854eaf5cfba461 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:ac4b1cf89d53f0ee25b1af9399150070883363d166a9f21e233034e9de1d05a5 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:9dfbda54e766bc6f6f921e0dd0fabf3c966b23fe730ec617608f45adbf72ce88 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:00c202f0c922d4cfa04df95d3eb457c6a10124f246567ca6fbf1927433dc4271 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:1d39151e60801ac68edbea19870ead806d07372b25d2303c2d99300fa12e8a91 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:c1354ff42789759da10a00498c996984be738acc7a6cb920e143afd27f6431ac |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:c6b8ab265a70028d07e3ef18284878b01a877a0f2a7b3cedfe1ca9a88f314b54 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:76c1b8a4adbcf14934a64e859a94f67aaacee98b2e34d0062246d6ef7ce114a4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:e69864600fdbc695da29373d3f163fcd079771aa530bc115d6370d9e28e2e171 |