dhi.io/cloudnative-pg
CloudNativePG 1.27.x (dev)
1.27-debian-dev, 1.27-debian13-dev, 1.27-dev, 1.27.4-debian-dev, 1.27.4-debian13-dev, 1.27.4-dev
sha256:1e20f8c9d9209cd3bd5cf2c19f0f4285794f0a40b938c8df788e3f0adf98c881
Manifest digest:sha256:36df21d5a0fed94bbcfac0c75818cef67eeae055854dc5ede032bae66b36b7c4
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:2738d4840f69682d66ad4115dfd4fb377d019859121eea3e203f6d1627831bbd |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:5d708fb18692633af2db8fd5ff9b3c400809076670ec7468dfd97b777169fbe2 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:1ec8874bd1400e4533dfb1c5a47cee48b51b82b26bbcd3b0f84c9bfbab61d676 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:53d1d837b4f39430b21bf1ab751d187301d76b3a209fd73d6811424602543a8e |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:181d34b1f685fdaa7e41e650cc301fc45454ecd2e5d186d149d5f8d2f53410f1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:a0986d8698d3c29e1b54890f45d16e386417ed4ce41cfa59e8ef564b03aa3e0f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:49023953567f69200cea63e5dc98cce6d19b24b63c00c0cbd8744183b9926487 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:c4ef2eba22fcd11cfe52898c8a6e2bc8b98ec0719f152fcc0e513af9587fa2d6 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:c66b2d780230bb5c58bf2fa193b6f096be938c760fa90ac057369520afd06a08 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:fbad8f878c84a5ebef45b37400da456bc2b0fbf7a1a02657179c67ca4fe76a22 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:236d2184cbec9e35ed12a1c6c533ef951cf80ba862138fd66deea2e621ea7b1b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:218c7612a399bf27de909aeb7d5ce1f8f1ef657177e4d6d3dff33da44477621c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:3ada833d2cbf819ad9315acaec32c4770e81fee03f6788712b2bf822374fe324 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:69f16504100339fd0bd18cd74d36086ea96fcca2b87cc51154ac67f418d10309 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:bc2cbc3c812f12e69c54395b6171a65ed7a10cbf06ae76a76b846dc4d3ec44b6 |