dhi.io/python
Python 3.10.x / Socket Firewall Enterprise (sfw-ent, dev)
3.10-alpine3.23-sfw-ent-dev, 3.10.22-alpine3.23-sfw-ent-dev
sha256:967d2cc399498f3cc4c1f84ea741665f22e39844764bd0fc4dba24f8de6fd574
Manifest digest:sha256:4f78642272b5970f2d6e53d65d542448b77faa26ab4965820807a8e7d1041db8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-sfw-ent-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-sfw-ent-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:18000de106f2ed942ac7f7b4864e53004b87e13fe9b9332c496f9778f79c1026 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:786fcc2f4dc636b716f22ac08f54870da93d7c2a84a5f746d8671771b8bfa62f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:cb9ef0dd48d0149cdf4a43d6ee85c7446842dcdf54747e6a47b9b843849a846e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:7d5ffde49932b5ed99fb26a1ee95411273acd4cf0b8d7ef7feba815bd282c9f8 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:e10c88bb2478889c62b90bf8e254ea115c37ee18aab072b69bd4b0d92e9c8482 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:52c1234793365d4cd5263b55d5fc00bd5d34a44002764c8a3ddd258e3230744d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:8e239408f93c795fa529882d7a0bc57d3e3fab2dcee30b72a43e9f8d1cbdff0a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:49615bab3eaf844ddc82eb57e3d572f3a9fb368222f7cadf94cf91315b156c95 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:82e87e18343827d1853fe4ce33937d34060426a49e94f6a2307a8d9cb40be76d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:43995d5c2a5869e06728843ec7162b56f053574070edea6279586b1ae9ad1bb9 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:80340955a0ee6d76d7aa18cdbbd7098df28210ee2db5bc86ffd0c1bd473db037 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:fd6f68700d9e9f95b596622cebabf5985b5e6d1073b70764cf8ace798192ea37 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:a90d88cd93e8a7764920935d808daa8c9769ac21cbc55f58a5b7cb3b6c7059cb |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:1847149af704757a008b45404f30e5f3f8c2b4f8c87ed2cc56825316100c074e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:8aebcb262e71c40465a84b84bc67b025cd290b55642de2f78d6144ea61c221e7 |