dhi.io/python
Python 3.10.x (dev)
3.10-debian-dev, 3.10-debian13-dev, 3.10-dev, 3.10.22-debian-dev, 3.10.22-debian13-dev, 3.10.22-dev
sha256:d944d47f59551e3511bec5c45ef066f35979ab151fac20c409d1b727f4c6b6fb
Manifest digest:sha256:23eb538bdee8692ed393db6fda480084e53c0206f5c949131da01bb63ea4e69a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:f2b9ed09367da3966810dd1f927f1587257017a614d6ebd0c5ab0dec2826a084 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:69841c7211b9290414d4d76c6b9981aed4ce3714f46aa0886f06a935450cac8e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:d6bf527f5c0c4824ed272635a59420147dfd7fb3b6f73b2a1350fda9db36a17c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:639270b510f7566c1cb9d7f5cbfc5db5a3ddb47cc6d2faf5f6b9af79fec953ab |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:1b242293588d383e152023b0a4541cd6ed76b743264ca9951fb8fcd64b1316a1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:5dc75526cabf41f22986460dd159b4d979139eeda66a5bd50dd214bd6fd4dc4c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:0c07d4f1f6ceaebca7491b8aa26134bb0adf14a6f3bc2b7b7bfa6b6a004f4857 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:856e7e6ff67ac6b1883cfc34443dba8615ca74ad10549369b6457ea6792a9520 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:0edacb997cce913e7b3fabf17db7b5f50fb757803f8d28027a68280e1344eb0f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:ae6511d5dfee0c655cb40092572de694b9cf098960a3bd9b0c71d6ea15debce5 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:3cf6722e9ad1a60f79899f209ee21eb9f107b2912325aefb5f46af9d58f1759a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:1a4a330e23d8d00f109c4977a8114f311a028f835d5ca67938b541b275bb4a2b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:34daf5da1700a97092d5e861fcaf745a4a40052544d9ca5b604b4c7f53e5f634 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:5ab0ee1189a79d72822769981918e1b4beb3497a225f314869a422fa7d2aea8c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:c191eb454a3f3ba002395e348e7ae9c6cf4a63d52c07984a193eb43ec4a6635a |