dhi.io/python
Python 3.10.x (fips, dev)
3.10-debian-fips-dev, 3.10-debian13-fips-dev, 3.10-fips-dev, 3.10.22-debian-fips-dev, 3.10.22-debian13-fips-dev, 3.10.22-fips-dev
sha256:f4a83421b1eabf4001cf850d128d7eeff8b1be4cc7fab831b74d1e1bac668f1b
Manifest digest:sha256:e9b28c743d082cf276b20054b8bfcafd08aca1822e885c55db1b6ecb9d9b4098
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:bd152262088eb054cfaf4756cd56c41bc2523eb5e5689cde12f694e82ccb2de7 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:87a80eb93fe80623c32d422ac410fe014b6e629128aab7a459bd9d1296d822d3 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/python@sha256:4bd81f49eaad61ce3c7ade9478fa5fadda3951d68403963def24097265123c5f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:bbc9ba628bdca8b06da0b585292afb5498a2d25bc6f374935349dd605bbf3a78 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/python@sha256:c8c148c10ffe69ffa4cf5b74fbd84acc45baf0ffb1203ec3313162dd0b7e27e1 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:e5130890563d4d685f37c1dc908b107afe5a843db88ec02c088d5b570f0380f9 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:2c7caf8a5918663e018a2093d42b6aa56c5038f0c0b6a35961c8e6c140b1f0d0 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:5f8f9a03e3388cdae04658bc86207b889465b5788a9f6a488d7309a773b72e45 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:9b663bdb9572d8c4765e6227b607b94fbd8a079b8d3400c49a1586ea426ad21e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:5d6ff52ebe891bae737fc715537d54fc73f948d8046a4c5da9653aa8abe8f6b9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:f1297567dd93f2c84fef23fe76686ab20eee17c8ecc14ca06413fd3dd210a2c5 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:9cef8fa83b3af334bcf898b8635df31f65ee56e95703c74fe1c0b20cd5cdac73 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:b52687c7e55225efb304b1025a0870b98cc2217fd4a87ead4b7aad17b98c6058 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:dfc65fc44ba54ef9852c2a8eb80f623d39e639e4ba35db3ff55ebab5dfa088b5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:ac46f48ed8612b8fc734340a5a188bd33d6509e40af579176921e5753f6976c7 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:e43650dc94bbb3e6398b33e3444f747468ff658da104b6de0b99e6a85c2fd0bd |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:971fa8f35fdb3edb5b5861867f8b745be5611f71f8dff6e185929a34f6d89b8a |