dhi.io/python
Python 3.10.x (fips, dev)
3.10-debian-fips-dev, 3.10-debian13-fips-dev, 3.10-fips-dev, 3.10.22-debian-fips-dev, 3.10.22-debian13-fips-dev, 3.10.22-fips-dev
sha256:13318f89903a329a75c0be4220cd12d7b0c81ebcb72c001c4bdc5f4ddfea02c4
Manifest digest:sha256:2633e7731757f7bb91269cdfc86caba06123efcc9b5bd7f26571889b6cb563d8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:879c3f3fa6017859499a913b66d1e6f84307367f25cc5965cb6421bf33fc1e71 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:94ca30ae213f00332a6d550887df30fb3bd5c2de18f0265a2feca6c0a0fb67ed |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:e3b51e25ed8bd7d7d9b74785ddab5193735e5d6b41d2006e49ccfc260090dc04 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:1d03da13d56dc0458a9614419461f4ca3c9acccb6b344fe4026b5252c9e3a4bc |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:32ebe47a0ab4fd84cea96037e38a889d087437b535fa63c42abf4995d1768133 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:6c84004854a795398dc77bd488ea249c7acfafbf138fbb39301026120a2afc70 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:f0b73005885f2db8a5bfece65102fbf566b8f289fd817629afd5430f9a48b17d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:d4e42bcd0e87da8c0b702feb2248a16731937af18ce0b2399ce97ebac2798aa9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:73a2fa91b5d8b6577d0a71f806b1eea1ab01d6558ed587ede2104b67d7d0b0cd |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:a709f4ea8b18a139fb96923055680c2c633bd1671fe43930337fd0e34af6ecac |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:259ec0ac1e3ff52b9d2243b42b106e338d4b453a0145edd7af5deceff6e30ef1 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:a0d64a6640df68d6fc58acbe9152c19ff6383cf16ccd5546c85f77dbcee3d95a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:00a4199db7cee679229905317f6ddbd513358d7c6ec8ac35f11c1425ef22e0f2 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:aaf47a201acb6e6905c05a83c014c1e5b57229afe8a31f38fa03e72f8a931503 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:a9b6a03279171c4bf980fbed3a86f8bc01708197e4ff302877fa276be1650c7e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:b1f591fd6e6b601268fb77bc061a6940734f4870a70111758fcaa0f808171bd5 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:f81d1b6813b6d9a0d5a50e688487ffb36e4abb361e8a083b839ac2b0c0feccb1 |