dhi.io/python
Python 3.10.x (fips, dev)
3.10-debian-fips-dev, 3.10-debian13-fips-dev, 3.10-fips-dev, 3.10.22-debian-fips-dev, 3.10.22-debian13-fips-dev, 3.10.22-fips-dev
sha256:7647a910f7b0f0723911a514f77417eb5ed7229a48fb28cc1fab7e831675c877
Manifest digest:sha256:731856525b2d77e39f86a658ae26ae5422d996c06eae6580b5facbf67213d5d9
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:3e647327cfe6c643015f4524bcbda591a762b72d994d928af8a707c455d2345c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:4257ba26f02580aa8c30f6d1459d10d372db490cd51f17c4ae0a23b8e93c24c5 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:969dde7c25168bb227a591c5670e429cc5e205f44cd320bd620c2584e18d53ee |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:7a413dc45b90bad9ca773888aa7db41367f6584f3b280dd05ab70b714a05e8a7 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:dfd0ee6701b3b42127bcc7874e6d708734ce47e1ce4d52477f7a9f059d26f75a |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:35d6649ea4d2fcd2fc6a2bf1cb0b02a26fd20e5ee4aa3f456e2eddb4434e90c8 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:74d7cf07dc5a925b0395996c447b8fe9dc0c56ad5ac96034c42c7b45d3f340b5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:fee3e1b526b05dffe49e0bc5da00faa4845bc994940d260ee42b86d179e87c05 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:2f7c76c3e5d8d6d1107ee5f9af49d33fdd3d1c57dffa6520717d0f92efca2536 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:33a770b37b08f043b87b454f6daa4ef30dae003d2493f25ccc8813104e4500f5 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:695f30872c796669d50683e9dbab7cef560bb1eb43eda7c73a1b95f4dfe6da37 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:e703e0055d2e0025d8340ce41d99cd7ca4ebd77b6d833f477156246dc0d758c4 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:d3c1953a8b9a22d43b049e77553ccb12099699e78fdaacc33cfb8e72f6bf1215 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:f8a88969291ad494c95d0c3f65fd4503561364e7c8519f885bb16ee4d9acf8a6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:c2fa92e2d18a8e3e1f195fb811e8488349b1316342a77fd091678fbf02e32728 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:bc0695c9ea01406f830e4f7d8cf677c5c6a5fd8de70702b526d6f5b0bf5fc03c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:62817001fff42f548290b1020c6a3b07d73d7699dd8b7222bea009ab01763fa8 |