dhi.io/python
Python 3.10.x (fips)
3.10-debian-fips, 3.10-debian13-fips, 3.10-fips, 3.10.22-debian-fips, 3.10.22-debian13-fips, 3.10.22-fips
sha256:9318d09409763bd5a5a59a14367d715146b341a88a5bb088b6408b02bd15def9
Manifest digest:sha256:f16f03d649ee082cb86787e4d475f248d5058a100bf1e68186bd52d096257815
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:7328a1a627190bcbaddcb30541e0b6863ddd330340fa555f9c6ec7600e4130eb |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:991e5bbffda7a72a4f545a1ed31216f26596c389ba84296fade2b754e704dd9e |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:9ac67d1f7a6f95ac173c0f99c1edadd46ca178d9036604124a79b5a5aac00a93 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:060340912d321ea3b452c45b3628c3827f0892fcbc16627c09708b4c7af40b13 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:3324904c0c8c03917add1904201c293099c721ba8af6ebf3bdd88abc403b5ea3 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:842aabfd8c2f1f9850f4f7a55bd1f3545f043f7ac793397d33f792ae335b8f9f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:7286374b10970b4a8aea1e35c23258ecb0df68a88eeb69e9e29fd27286599386 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:3486246172cb8f1bf22ec9751b97eb600c5a607f671a8d1a94c84a1bb75f6c4f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:00b563dbe2e9708689dfb540792e0d588b82fee8915b4344877b0efbecd187d1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:dd91405e7d55b90a1847594c1ed46a6b6f583f234c10a3d5726dfd5ec181a37c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:eebf1868b7a4ae2ac4cbd140da6dac4208020730b54bcd55fe6f41106340e0d8 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:6059d8a775c3442b15ffd2fe9188f31558c48f4a7e2e1da75510b0ec817d312c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:6b1e156405db6c75e09ef9bb3c63802740922b5507fbed3069b8a8df20e35647 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:b12eabc54988ac5d68c1d3365134c958e7193027ec64af066a48ef1375859b11 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:51087f7b0c0f56e4dedfec70d557eed38ed203c2e290f7e7185532d064152f60 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:d5213120c91f4a7755c4e5e1121838d4f1a73d344f454b43f1e2c85da35433b6 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:b76b92fd2ca0eb983367e7d486e335d881a31442fac31c6d4358c1e9c0257281 |