dhi.io/python
Python 3.10.x (dev)
3.10-alpine-dev, 3.10-alpine3.24-dev, 3.10.22-alpine-dev, 3.10.22-alpine3.24-dev
sha256:8bc562ce5b2a80f5f1ba72111c7cb3473bed4eaa50ca59e1b9ce98e320e1d9f3
Manifest digest:sha256:f35c4d052aeb774168eae628266e9d9e522dee2a100df56fe8e9c502e8ec38b0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:302a56bfd04b92ca78d2e7d8fa3c13c555fa9de66e80b2f71412bb37efaca766 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:bef0ba0861778b7fd2824dfc3827228aba79be09ec05dfc373f8c103f0dd847b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:2e2b5ee54fa873074a9c3f2483859f9dfdfe28ba8179c0fe997b15d941fb70ba |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:453dffb014a2e2a4ea69d35b269378717c51b42a83272f78cdd9616dae4fce66 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:c2012fa788aa4770d7a42057f2a3900ba6605c526f9a2970e808839debfbf0b4 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:e4e4d8ceac2c89f41f6f869020f629368bd16135eb7977ae6dc0314e15171acf |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:abb6506608d285864dea38f61e2d52cb8f0d04ff7856272d3a0c7aeddb3cb1cb |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:f901c0f179f94994858387b5a5edd85571c81f939f3de18ca6d970bdcd1daf10 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:356f97daec00f712b6edf82701b6d1417769cf7fe2f4b93e100fcf691c8317c9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:25ee9220f7e0be5dc2603576d930e1e7e3bb0e1be4d93f463412e00f32ad32fb |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:06558bfe2dc92852b73be1d5e43638b536a8c9029a65fc1d01ed92ce1d22c60e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:f67d9d2ab1220888f77163d0eb7bce69d50dcec504ff6dc0c78f55169a98194f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:d731abcbc71304a2633ead8c4d930f27b41bf0a13a27904e367b9492798a875d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:f780b3b64837c5d0afa9c6240e9a5292eedc2d6d7cf9dee05be87e2a9a67cd41 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:2d8f09e71235c2ef337bd73bc2c49825a66a0768295ad8d31911f51ede2e6d96 |