dhi.io/python
Python 3.10.x (fips)
3.10-alpine3.23-fips, 3.10.22-alpine3.23-fips
sha256:596400544e3b2d0a8c9fa56b78f96eb4753c04bc58661e48a8b96bbaae176fcd
Manifest digest:sha256:aaf6f8fdafe89f2cede18220519286120da8121ef638fe58dbe6ae0a2f59c4fe
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine3.23-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine3.23-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:02e38e7153e8c3337f1d7e38cdab2c7711a81f5a96e6a23feb2dcb9a8bdb672c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:a05e7cbdad80c343cbb2f48961d797c5087f58975c644f959798bf3a445ae634 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:a62b893cde3624c56de794fec2cc7b173839ec5adb90a1dbee442e5f3a7eaa59 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:7b426509e14f92bc8876f630b4fb64b4c2b817ff9392bf2063f33f826682b10b |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:ff9b3eb386ba053bb4a0def173bdc9154176d1fa7c8b7a2471c3db9f94efb88c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:bf451273121b33375646bc2ccfeb67c5a70063f9a9a595142532cfc0981cb6af |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:cd50cd9effd692fa03f8ca35d064e65ba96626b0dab74512952aa526e1751b3c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:77524ad8ca047b4cafbd5bcdd6158545be89dc12dbc4e3f5673171b59c504b86 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:7f51bd47574ce184a27660c79e632f0eb65e49a8d783a6bdb8e17f37da982494 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:fa5753c891b360eebec57d0e63c02f160bf55d206ec93ba179869f33627185a6 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:ac2c73aa0b135d7224a4bb6214d2f13b31558bb73e901a6a520e0e7795f6e6b2 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:5ebe37138ce4d200be7b0153dcec0e32d9a392476ec2619465bb5d076bbc092c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:462daca52ef7d1175f750750759af1a86c5646f537c755007147f80c4c47fa91 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:02da5bcb86b633e893cc903c1bb1fbe233b10eecc5c23685976e2f213de5bc72 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:68de7c4d7a4c2d0996d6e757f5e63a11909c611ece7471e43d3f2b67ff2ace49 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:09cbb98f26c7ad2f70592891207125eadb299636bd940847d0498ac070d277a6 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:bed8a6ee5442bef310af0c8e7b315e0161485f7deaddf57ca566c8691f18a58f |