dhi.io/python
Python 3.10.x
3.10-alpine, 3.10-alpine3.24, 3.10.22-alpine, 3.10.22-alpine3.24
sha256:e3a64fa6616209dd1bf1781961d4b846b3d556c9c7e3963311652008c57a36c1
Manifest digest:sha256:201c53b94208ad152f74b6fc2d8c2fe0e629497adfcea6c3ca862319ee064248
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:569357ce6a09b99622536e2ee4c6c07e29a5087ffec3abb80a6a16921b919f51 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:8571c4349c462944c761d0bcb005de05a7e363a453b2c99e91d4d6cefbb44ee4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:eb71127a81e60790417d99351db19edde6507a32d0ab27174ed4e700bc62c655 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:f1330ef18fd96d296ceee45ee8c8512072f65d7a9c10f77adfa365b8fad9c93d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:64b585ad6274343e0767ab0ac0f1cfe30490feb199068c26e0fd8a942a1c544f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:ccf29d914d79de44aedbd6a1b61aeff02ad790395b0e3c8e58fbd6ec7861d1cd |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:c4db4c47484bd34584c118d15bdb3bd4e21eea177e3b394719c1c6b9a33e30f6 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:3cbac83f105d470e495229375df2d2bde4c3e6d5ce42a5fde07627f07b4aa14f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:b546bbda201e539b739ce437d3bb59a4a23c437112878ee4737192928cedb368 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:ab300c2dcda7a455f945150a22dfa5bcdce6d09ed1831cefed90b5694488aab3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:6951c75db4b553ff0485a1130460e047757a1e988aca4f88fc6ab261ff26d340 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:090506b4008fdfb7fe59f6b58b6eaf0d95a788ad717b8d8fd8b149dae4ee147d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:f197d08a1222c58f0ec1bf39e662e1f3d6960cec4193978b56a0869105bc82de |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:fb7988544d587ecbda06ab088542eea67b85bd88c22d8b14da9708ef42a0a377 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:8f85507ac7a7ea4734416dde23eabc9c78170846824c011769c9bba427a09b37 |