dhi.io/python
Python 3.10.x (fips, dev)
3.10-alpine-fips-dev, 3.10-alpine3.24-fips-dev, 3.10.22-alpine-fips-dev, 3.10.22-alpine3.24-fips-dev
sha256:9f72aa8cd5aa5a5ce1bc710fe7ab8cf19cdf6b09ff60fe9fc262a8865f3ea88b
Manifest digest:sha256:78bb24b00b192154bc9f132703f687d92a25e363ff084ef36501ec1fb0f7da62
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:d36ecf7dacd521a307af0509f9487910538f9cce176cb491fb4ba2ded5ef4802 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:57d249877dae36ff4871904b45a4e66ecf34dc8d2f9936b566185cab2c4c5d4f |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:7601017afb8b7a816585690028c233c6afc3b7f5b130ee09e4260c9f949c13f3 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:045bf2ff7dd3fff90451fcfa863e4e184442f92297df5c001a529660868a4859 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:e1852c94349b86b5e1ae2fad50ed1387514e138b2876f0399b8e70d5157248f0 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:a87d99752e6482bf402dfc8d29a1bad5975e61b127d3a5a4c0b5b0c5ff4326b0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:3163b0b18cdfa6edcd83512bd461ec9b5492b9a222a89a0e4e910a7252b815da |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:b3049c1e8bb54f2075bc43d5a75373d527d54218c7f0d8bf137c5da0cf52c83b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:6c711cdb3329ad5be4ebf63d664da1bc702cc0a21723afc7187bbd03f6c8bff9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:8c370e407451d1e2224c7e0ef735a2d722ce42eafdb8ab7c8b010c7751d32ac9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:66aee14c7c83c1b4f09e9b07d8515f86ea8d5252a5a60c4ad51fcc5946bfcd9d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:b4faf3bcd14955c351dd4d86563df7e5faef8e95eccf5d2ca491618658de99bc |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:ded225a5aac9415f7f39d093067fc65bd38a4b84527a39b8304e368fc2151d1f |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:4bc1ae6ba6443b486eed1a53a069edb1248431a91c9ea5952df64662ea5670e8 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:367c856a7676250513e62537a5e43bc817bd3b2432f1e749859a7e26c60e5d4a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:05757531140ab970ab160619d2fee3df378b13ee62c2022e73d0488025513c05 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:2f7610df2a41b6861654c58e0de8b3a6196c6bda07568e77818cb98da03bb57d |