dhi.io/python
Python 3.10.x / Socket Firewall Enterprise (sfw-ent, dev)
3.10-alpine3.23-sfw-ent-dev, 3.10.22-alpine3.23-sfw-ent-dev
sha256:637c1f77c7087c920383975921d029c225dfc91e882d20b5c306adeca062aed9
Manifest digest:sha256:cf6dcd7ffc2a2496ebd79b841a8a58b8565dd189920fe01d9946e4d05fdf436c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-sfw-ent-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-sfw-ent-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:894ff82e108659e6f338084af11b6c88a7f1125cfe937e74b1961dd49aaaf456 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:ad1f12d2d431db76f8d4099ab9f85193c4627b3c2b77e3055653f7ff15936840 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:be6218bd10b0371a014ede0a162be76d7e1191b21a816a56015ea84490ddfc82 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:22680aad15b7df184fe51e6b767665fc3ffd94c41b43a4e81a90977acdc07f21 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:6f070f7dfadffcc3c675ac1f6ff8c3f298acc17480d422ba252fe926c424c864 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:5501b417a2382eb62fb6ec6f88766e32083802f52688339b09b59959744f0310 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:98986e042471e8458fba27217d9bdae293999db3805b2e3247da2a3da5036e5b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:cba2604fe18335640180bf314366ad126c0faaf1678a77939037227b08737d4e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:ff783e459bafcb713731a3c410a1adc77a705c0a15cded9e6cbe9ccb3588c6a7 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:821cee5998865ca688731f06b27dd8c522cdeab9966c548b147b965babba12b1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:866906ac57a4243da60a22370d89e40143399a5e1e2b0277aad4d59c4c181b97 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:c6f2fde7486dfe0cf7eee91db744d38dc74769017a938c65f457a122c7349688 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:6a1d7465c74ffce594672a3f546368b239255e2001e11ade1fd0849269be7084 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:0b9af655eefb54c6483ebc4f89e531adb784dcc8f8772dc6d6ee884b82d464ad |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:b362774ed8939e299d2088fc805dbccadd9f6b00f8870a322f44acaf84b71f11 |