dhi.io/python
Python 3.10.x / Socket Firewall Enterprise (sfw-ent, dev)
3.10-alpine3.23-sfw-ent-dev, 3.10.22-alpine3.23-sfw-ent-dev
sha256:4ff56ac3763ba277139ef77da655afd0cafb478bbbd528cf85553d8c253644fb
Manifest digest:sha256:5c9498234ebe19f0411790de4dcc692ade8ec67cc52db525383cf18941c3eb1b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-sfw-ent-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-sfw-ent-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:b6cb7556036644c2aacf393c261ba5c8cd95bb2eb1f48d234ff53698ec9694a5 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:eb4b240d79ee7c7e66de3c93e1fd59f30714a2b4aa6723c45df262c516c13dec |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:024910cd8f2fe9e2c430cc892e3b0e062a6533457bb63df5d1e684ce15804005 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:3a6153104bd9653e56e81a566308a5acb49d0a2846fbe6a21afa6b5550c88e14 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:006cb303aa5f77cba3466581ce519b59e2b8f1d5ceb67d2a4e9299d1e3b36e97 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:80eb44d31c2355434f0f6eb03c6ac67a9e75c589b3db42cf05f2b69d343175f9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:93f040e4bf9270b9389801befee12235fbedddf8e7b36530a340db91002f5c3c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:13065ced893e77616169ecab6fec964e4ba48380df76d0ad30c3f928d8fe6b31 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:7cace46c11658bda8d850291f3ecbaa63ea228655c4f953aa5c3ab73e9a1079c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:7d85002c200cd83e2860178b2fee9c0275c849833b598dc85ac012f0c01ad96c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:087ff2b847cbd2b4a820e365ce5025a7f8f0825fc2f17f591722d01d9e35fe7d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:ec8abd51184d37c18514b0fb166a8a0ff3437536eee4f7c0dec4c4af9fa5e8c2 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:212fc29f955b0637419e952592ea822b5f3f73b956e5ba03fa1dde7db1b88a28 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:02d9c1b7b8823e09f347ff8a97b962abc7abeed534466c5822d4101eefab56bf |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:88e7aa4476f91f93cca0f7e15c3cba79c3b1ba7b178fb5cb89c95b082f46e035 |