dhi.io/python
Python 3.10.x (dev)
3.10-debian-dev, 3.10-debian13-dev, 3.10-dev, 3.10.21-debian-dev, 3.10.21-debian13-dev, 3.10.21-dev
sha256:909c51a34423488640159f35d3e39ddd590d9115cae256f40078a729545901c7
Manifest digest:sha256:2a50943c63c55ae8f2e572b4f69b131a680056a2001fd7b0a5a3c6a7c7ca96fd
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:16855754fcd3bc1a2479ac2995376c75f7411e8d0c78631cf1372cb0d19b4dcb |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:5bb5279b5cbd19d74579be7a9408154175fa22ca3d52038f1edea7df6baa0276 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:5fdff6b6f5d29df1f2eee0cfed095730bda340742c4b46b12b80c904373386a1 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:edf405dafe27a20eaa0be9bb606e79a714e0a58e4c532bf03a2e896f43e94f48 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:6850d06e7100ba1bdca606b367f13bf7ac0609eabd9ab8446fbd2036b92795b6 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:bfa072a647c07c8107d6496c39a902527253c42522552d3bc976bf4a302b9d7c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:faa5baacf446080c687727e8112999214178b9b2b81adfb02ef5ebef28bcf0bb |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:2b991a9da3607878a2cc08ac1c5e295442abdb19d75b2fe53b7a03be2be6c735 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:8a34328920952a2208368e66bba7ca4b895de5dbb3b79c3680eb6d1e4aaf5425 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:7eb4b05bc7bd0d961a328f90ae5025abaaf1867533cdf2f82664e513fd90de62 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:c86e21e608e929796a8791f1dc76d70e1f8e34af96e61390cf7269b463f44afb |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:5c0c80ab0c0f4af7e4e385a50804bbc5ed137613a4bf273abdd7cf768b2ef119 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:8cef21225e62c33b79d38527cb953e7be05ffe242241ba562c32fa17612fc7ed |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:d06b6abb2f6d30cd95aecb741b379eb90c6c546521d792b3219b913e1c291a8d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:83209acdda380787352038cd22bbc5d1dc1fdc366cb56929b75dc67f9a3208c0 |