dhi.io/python
Python 3.10.x (fips, dev)
3.10-debian-fips-dev, 3.10-debian13-fips-dev, 3.10-fips-dev, 3.10.22-debian-fips-dev, 3.10.22-debian13-fips-dev, 3.10.22-fips-dev
sha256:64eea93c40e9aed46f9dc2c2aabf49b897b7ef1862a37ec215e2c5b0b37b12b8
Manifest digest:sha256:07f44f91f184723545f73a16abf66bf81528a63711a75372ffb940bc78bb9c7a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:f100252929967eb70e7cd49682c112cd8b7f1748d4e242222bbd79e8710ab7d2 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:8bd55f0cc9510a3a44223a73fb5246eb3f0dfe7f64827d7af8f53b6e2708e312 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:bf4c0a6cc4d681508be837e409bcb1592eea68ffa9bc9105ef9b90d135b92d6d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:c1020eb44b1afcf15f91b155b4ee430dd23fcb237dc6a1e9aaf10ab831c08564 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:98d4de3fbb99430c50a5fd2c0d39d4320dd06acf9ab8f16bcb2226d6dfdca927 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:0d690a03ca9282da3a23f86f3d1784fed2d3965095e1af49e28daaf05ac0e7b0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:c268d0caf34f72aa0e766a37afdad9329e661686ceb2172fa5780ca5999a7df4 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:0decfe939cc7915e7a009ac3fd54ea8c24c147bdb1fe13eb6e69c66afe384522 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:655285f7d74c17014653ad8050e1e9272a837a417d3af3644c9b00671698ddd3 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:b4a189243d5943f395fbf7b47b1489191d12f7fd981af33b2bac853498a12d35 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:f168712a45f65307990b9d7d361317963bc48cbd70121060473a9b21ab8892f8 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:cc2110e010206bdbbacb2543f229fe6c95466e96b34cead2c8eb23089d90b031 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:a5f1ab40c4d46400375beda37c631d1e5d605abcbb58d06c4b262316d3337205 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:cda488f882f591d156991005eefb2214920fc94125741487b76c1535582bfb6a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:211ee7d8381d376518bc6c4845f476c1037852e8ce0090cce83a4e379155fd3c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:5f0b409a4637d989a88dbac984b928afedaab1023b050beef5c720907a314106 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:0d285a7c5f194ad4b235e2bebf7c0ed0783b94a7064f283c8919bab90b01c23f |