dhi.io/python
Python 3.10.x (fips, dev)
3.10-alpine-fips-dev, 3.10-alpine3.24-fips-dev, 3.10.22-alpine-fips-dev, 3.10.22-alpine3.24-fips-dev
sha256:49237cf43bfcb549bbcaa77a40eaee0dda4d77f1df15d2bef0ffdacce744ef47
Manifest digest:sha256:4cd60edf61565558cef62e8e99a45cfb40fa9080fbb4309d14008da12e03a398
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:5ca75f250c6670be01627286587676c18f660e63d1e339054e462c1f56fd9855 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:62804d68cdae666e30087b4147353e194cb88e2b2e7eb7bb4af59866948e42bd |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:f72ebd573946f348495aecfb7ae7523cba6ab2c95a3d99e9e2a3153866f75a0e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:cff441286585a0b47a2bbc047fbfa5972dd1325617cf701cbd7bc777f3584e90 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:e991bc5a449a5e521a5aff624758a45cf67227fe0bbdfea28aaa72b0c63978ab |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:7bb6a8b45bd001536ec3217b2ac95456c386545837e1187e817e6ff13aff2373 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:87ad7b9e0041b28fadcafd7c1f41a208be61f9f161670340612d5c7fb9110d52 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:7d7df910e5237fe9127e91518ea6c0a5374dfbc36036fd59062dfef842b0ec10 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:3d650a340720ef932a7c4c505e27c3b8644c4defbc98fc069f3d022bd989c1a7 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:5a19434eafc2d98ebc19b598ed42e9075a8d28da8aa037e73d661bdf50b3eb99 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:d6280afc63a4926087ca6b3e94616b2fa0b7ff370d64bf8883a5c9e2ead33747 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:918d3aa2fb11f75d6c916812404a316082feb25c5105f1337b4e7f2951af9e53 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:4ebc894647624c590aa3460aec7f6a30e23ec6120442ae0cffc1ff985b90f83a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:983f88bdf4b1680962aae60bf016b1b57bd166dba1c70f06022c62192a97d0fb |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:ebd92419d02896f4068a52277b6a92560213cf52ea096ecf57f9573a7865223e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:3a888632cecf69c0bc74acba0b25a26333dddad6832b2fd5203d30f6ac8b5833 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:deccebcdb3f2ff87d0b37b8f205259054af6f44adcf90400c7a02922a11368e4 |