dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.22-alpine-sfw-dev, 3.10.22-alpine3.24-sfw-dev
sha256:aa0ed6781c1d32b03fbdf610df1929ad83ecb254149719d480f3d2c79df7baad
Manifest digest:sha256:776e9088b215bda983c27c1e4ffc0c16eadd69587fff23c2a80cc9f3e7fcbd20
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:88cfbaa28e7fe61ad3b7eec3b32a530e28de7f1a92f08e641dde5f7fb88a0f2c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:e37be9a5747e85bb7fb8435b092a10cb63d5bf2225210707ce5557ba5d2948d4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:f38340969a0def9b7ee6b4c7da5ddde43ef393c950d5480bcc6c7f6a7cef8622 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:956d2a59d3d4aaa0b62b1b81aecad245b238cfb9fae1e72c36fd07566b8c637c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:1a8ed736871ea8b9e3c6669b8ce5779abfd6d391530026db4c8f98965b29435c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:0bcfeca6339bdd15e0f5129e7df81b60d15a6f12622dd10439d6a7a8f36e8af9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:35a424675306dbcc01884102db8a5cc07843361a1758ecb4b7af21fa73fcdb12 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:35f4ffd8dcc29cf02babe9c55db88ebcf97874f306341e7750d0c06c32221022 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:ff92c662479980ab841a8bde95b7eca15e68bc8d815d5f553014f496a99b4b04 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:5e6ad2757b5e045e8e9a7a40b48e3c757fcab3a405d3a2122ca4406916ae613b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:d1a53db6b116922214229169a15f5bbb06e98f302b97d8ec8682bba74522f73b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:eeddcab58ddb05ccef2bf17cce29b41e6f69fa7fbaae4128484978250b3e708c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:b13dc5d1307a3b988c70129d5192cfebf2654e9482a0ab608496a45af5aaae0a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:f50acdbb42716db2d4d177b23b67de1a3a3d61fedaabdd2f8228fcedc2437dd8 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:994df3fa4e554a6e3f0ecd35ab418ca5dc5c60254b7f09e7b8dcc9cc71b8b524 |