dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-debian-sfw-dev, 3.10-debian13-sfw-dev, 3.10-sfw-dev, 3.10.22-debian-sfw-dev, 3.10.22-debian13-sfw-dev, 3.10.22-sfw-dev
sha256:46b8e3316abeba07dd0395fbe44f9c528d40d3f7cd48e6ac053369327ae3fd60
Manifest digest:sha256:96f59766f1acbd42a26908d86efb4c7dcb6a4c67cce8a09073f8a1fa181150c1
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:d9115a32a52d153c75fae88a2278384ffdfbbc081e88705da83a3554a3ab3a6d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:8ac1968e308efd43ddae39ea9ca51a60b2893faf6b6c342d7e8bac67f3b728dc |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:d601a2f2b297683990fce9d94b694399b063dcabfe0435d7f79d0d416c6ad304 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:01135539875023c9910782130fc3201fd6576ee77d73193f14fbd49363ad9b81 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:3e9f2c671ba56d7ac3561b52073217488420ddd7a99eddbdc859524fbd629424 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:7d2e736a17e57a371ccd5f54be47bcef4ad0d3f13ab27855631041250a5920d2 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:7993a6bc4970c72f81b3a3e62d38d783322969d5179784b024b1aa689a13b5f1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:16c7eba1abbc782384734b43a47bfca5e2dcf82e4ad831ef7782a83f7f401b56 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:b22c24c7fb94b146223a5cd6621b6333c7894593ce155bcfcc2d91806bc5bc1a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:5f696580d90ff59ad5e2beca2d68d968cfff28237af2e62a0921ce3566ca461c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:9240c49f3e843659fb2e28a1ce99eae2665c9db26003200489ab958b2092b645 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:fbbde853472761fa54dfed88d15212ad4f8eab260c46da724e1b66635608a83c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:f41591861652fd6a41611b46ed4a30b091919355fdbb8473350309900d9c9b6b |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:a645c8e883c5b15f5e847f2e907836e47c293e6dbac3a73dfe5734637bf3af43 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:c7d9e6f7c533e50e77a6f83d623cc2443e8364a6f07fcabaea0fc35799f11b89 |