dhi.io/python
Python 3.10.x (dev)
3.10-alpine-dev, 3.10-alpine3.24-dev, 3.10.22-alpine-dev, 3.10.22-alpine3.24-dev
sha256:086ed6ad04801c27d8440d3a5ca6dd7d05a00e317f10205b93d6ebb9fd7ff772
Manifest digest:sha256:57efa7e5d16bee611115d4bebe712a87a41a2105534f03c424b74456a9878ef2
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:40b3d49f535af42ea47a90ba419f8b32ea1f5116ba4e97f052102c8af6adf8c8 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:76a92f6a85c96a947adbe6110f60cb003d3b633ea889203b36db77b7c3dc0441 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:145e94b9d2568f272c3f579f8d97c097dd102b94f17879104edee8c43a9289d9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:1fe1cc25c6b740bcf874fd091eab6683330f87f58f64823352e3840115bdc039 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:94a1a11318e189c3d989a52c555da87a426517fc5c940aad38519023483f6c2d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:e8e26af688355cc8d32fc2ee50e594d24363fc2393fc5f8eb3e6b44046afadce |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:09415f478564cd42fe2e82b2b6811e535d669cf982429849c0d30ed06f61883f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:bc1480398a4c9f710b50061a3b4c9f19a443feb36833526ff802b898c69be6f8 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:5adc4040c7fd204e0f6808e3ced4a4ecad20af379edfa64219a7108bc0644436 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:c67d08924c437b460ff463aa3cae9476a6eb3541a0636f3f602729f02a6d3a72 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:8af264f30bf1311eb191b470d31343720c3cc21a9f59c5fbf523bd453490dad9 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:3102f8b962ac0f06da9f8b0d8ad5a89a417ddad36a5160461c03028676fdd258 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:f3acd9751984cb2543e8135afb216612ef86fee19b0a2b126dcaf44078d4bcc2 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:53132ba4539f9b9a240078a989c97f46e1798c88e8dfaa700f34aebbe1d78901 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:991cf121663b64618ab2f66bdbe60d53fbcdf3a1ff1939ff3d8bd616b159d061 |