dhi.io/python
Python 3.10.x
3.10-alpine3.23, 3.10.22-alpine3.23
sha256:6304a065c23772f784e833c44b3dc916d7764f8b0fc6e0351b49f4a4a4172f16
Manifest digest:sha256:0a12e19f238a9968d307044ba6fb0459801452217474a69d3cc79956561fd127
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.232. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:be7614860726f4417f6740a505086f5e3d5ce8312b3dd9463069a21715af457b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:a82e581714e568a95dbf0d8431bb3a56298d84947640b8b0d0f091e463e97b32 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:22e7ee3030003d3343169212369eecc909b08b1cd9e8ed7a2a35b8f3c0e71e4d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:a6853d3d249e859f19b540cdbfc2796010d1b92788cc1adecc995a5c6894eece |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:45d6f973bc60c82cdade230800b72cbf1ba1b93d6a0e71912983f4685d6998c1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:aa4e502a3415887f824b0ac1ed315f6a85b95e3708d46a0f7bf349f2c650f628 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:75229d0de29b0043a3b54df8b0263802749364de94ba6967fb56afa811e464e3 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:777957f2ca04f8860469b0acf90e0178bb03f33b9736e3d8ca75f90bbd2ce516 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:f8d4403e743541e258d97df0fe1fcfebbd212110cf47cf9ac19fe3aac85c5c87 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:fc16832cbcd3fca24f5c9adb212b025f14c9ef69991cc76b31f8df0c60e55f20 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:a83ae8ada51f2432c9f235d6663e6283d28e6d374c6e0532ab966f9d98912313 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:9f05573acf69ddc09106ed7cb2450569150afe013466763cc1411ae0973c75ad |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:be3124e0679546bc82ac4671918075c203e396a30acae2e5c7a0718c4377a6b9 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:0aa43d67392d15d1ab76b15c93ffb78345f8fe3a13679a590e71afed1248e0df |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:4dfbe8965be71e37b50586686b4560cf8ba7cfc6f50c1bbd72bdc5cb6653d311 |