dhi.io/python
Python 3.10.x (fips, dev)
3.10-alpine-fips-dev, 3.10-alpine3.24-fips-dev, 3.10.22-alpine-fips-dev, 3.10.22-alpine3.24-fips-dev
sha256:bc68bfd3741f7af3352825c5c68d05b53a94cfdc76f2d8bf59a8affb8703bde3
Manifest digest:sha256:b225fbf5af8600985c63efde3c3063035a3f0fe7ce17686fb769a426b85627fe
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:74b684dec3448b70d3c3289d254f63f06b7f39082fa82f75b40d6a8632fd6f4d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:5793c4455cead68fdd2aab29996d448e956a36daff3a60f215642d584f3f4dcb |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:535b356b57d229d1f384f3518f26fe5a111ae665345e6a3f6a627062ced8ca7b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:4d23539570dabe5728a8a3af1eafba6dd1d573c6be8b27e8be49f78890165874 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:93866046ca001174b25fcc47bc259aa558b92f634d7372e53c5d10aa53718f98 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:2d685c14b2cbf56f9d44e30d35c729d8ea3b9884d3bfacc1b671e647eb52c4cd |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:00b2bc8e2b80fb5d9dc6e5fe8fae3e7ed6e7ed82c3e239d0d5125c92d3ccbb45 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:bd733731ca213f17809df6c57e8bf8dc2fd776f59469c298aefb67bb4beceda8 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:e263ef71810f94ddbf299582fc09b3670e3ca3bb9fde0d8cdb6ceaf8677dd584 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:d143fc5895a5f467cc9cfb08e08f005bbaadc53fb923ca611fe0b5ca5655758a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:56ec266b986a44a493b7723d2d70df3f954719f386c73b8f8e8a306308619a94 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:1d99066f781cd6897a5f7b58e0b07cd3282826d6b43a70bbf688e6c24cd58673 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:582f09c4e9fdc192e0d41a386b63e84eb097be9bd88dac55d39c709fd183ac0e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:a618a9c767c6796bdb5cec504b38a757fce339932f267642e66a488b202d2bd1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:719c1caf19f325dbfae7d4bd68c5dd7a621ac137328579ee5e5b030b779f6d6a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:e78c6599d766ddc04a24d0e1f987e11accab878741d6e76877090a1e47317005 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:6353372368529158310be787f638f1b0281f4aede44e17bc33197e372ce57fb4 |