dhi.io/python
Python 3.10.x
3.10-alpine3.23, 3.10.22-alpine3.23
sha256:74cd8ebff190a47da38461c639d251c7669fcabba4062f17a7345d32d80482fa
Manifest digest:sha256:c5a4babf9357f496f8d99381fb3bfad413d6d1b4d6e2fd8e13a02d4065f7254b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.232. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:0e9c0a214d9ec84c810dc2cf5920c8becf9f6f0fe07f64e05fc7c595ea059d48 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:9992a661254774cf0199ca8fd831ea79dd23a2c33c177dd4a58325ee9dd97740 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:1ab92e229611ee9c06055331145bbbcbb4d5c0301a76ed6456db8e2eecec3d55 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:c09a033d480b90216eb27e410f04ced3af1b2886c8c7c568409541dd0528d5f7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:281110e9356640372724a13bd563f06e64be179d00dfab8df002b8a67793e3e5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:14f52d3fe3df699aae530efcffd50762f932522719300759d68dab119281a708 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:ed62d87e9206eb0ff6613fd88b5ba137cd4b9c86b60d9598fd8c71e239d1a441 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:8e9eccf8948ed072ddc67ca54ab5c5f85762b0ef7ff8838f27cb48d3e21bbd50 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:c531afc20e7c26c0bbe6f0c8a51ce4ca38cfed7ddc8a0b34331a4fbd641d73c0 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:4f0be572883501811f7166fef28a0c4498682c3b0fc430eed0f4680edabdbef1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:a60185fa89f81bdc9057f497b09473c046baa68e7b94c8254406e52a9487e104 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:f971af93e855d2d1deb8fa5d82422e4c706701aeaab5c64522b75b0b4afda5bd |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:e86a19975fd76d6e199b6533f8b032587adde8358021826fc438475af2813839 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:63edebbc964c6da24f3c827e5a49a478283047a71ce8aa1f65917108379663b5 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:cc4eb16383278d39712d561776a78eb2d8036773bbc2735f55796c80f947a054 |