dhi.io/python
Python 3.10.x (fips, dev)
3.10-debian-fips-dev, 3.10-debian13-fips-dev, 3.10-fips-dev, 3.10.22-debian-fips-dev, 3.10.22-debian13-fips-dev, 3.10.22-fips-dev
sha256:67c331c7236e6f5f6a30062581474076993d8e1f79da8234abd0822e9094ee97
Manifest digest:sha256:4da652bea9a4a42688b29e5341bd2accb07d0f1a8e174861b3f7507505bbb1e3
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:e40b7c05fced55f1a69decc405c252c92da2d4a9857fe883dab0cbd75495743b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:60a90aba170c51f93dc245ed4b703e42a2405ecb77243360921dfba32f88e845 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:e6ea94c45e097e9f47c3a7c3aa01a719ac7317a36c0a872a499740c042d13da8 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:dbe26da1a632aef0d78b840d07d46790d4bddcddaaf3d7208396246e18b80fac |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:816afba9a0e2cddbdc314b86427bc5cdcd48f872f72a57a98de62f4505142ffd |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:3c0b13edd8a3bb9abfa8429af12de394eeea5d8ba0ca720b72de54f280f30bee |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:c66ecf9804dfb61d260298cb8e3d7270142b308f1dd1f000590234b64824ffe4 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:70c37ec761c351be087cd3980fd2a9d6ac3b1ba3a4c1279038b3b7e60b0bce4d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:95fb34f7d1f5f907ade3baa3ef77d803ffe6f1a44ae3d55aab8b0b6514bdfecd |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:4e037d10ee7510cda4f5ad2e374dd5b6a59b21e7ec7821b21c499f7f26b37a7f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:417bfdf9e79b65d51aaee3e69c8d050a608b5047c4753f1b0069e919dcb56347 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:7b5a8791054d339bd036632e9ec189d29d3121b68a95e1bf5546cb64c3bfdf26 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:38648e8ff34b3259204aaa996356407c7a80f4e120ef4de8caccd44c90411b71 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:bd2c2d59d5f54d1f2fc578d7bcbaa3cde748f3c07b7d2fae17777527494b4521 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:e1eb06f56543bc485ad45371acfc796d0591a634a573e4b5e9959d2f59405ebd |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:70a31ef72914186689a6f4bb4b7130e5461074c343685e98305b10f401eb43bc |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:186861fdb71be1811995693adf96e2e344d50f28b01db9b4cc6526e5295f273b |