dhi.io/cloudnative-pg
CloudNativePG 1.27.x (dev)
1.27-debian-dev, 1.27-debian13-dev, 1.27-dev, 1.27.4-debian-dev, 1.27.4-debian13-dev, 1.27.4-dev
sha256:4deb84c04e26172f0b6285ab2a1930ed69d89bc1f922072221e88edf5f1f4705
Manifest digest:sha256:7c6396b47ead0575003d2f21f9e4592d7cdba0a15d9ca296b8cfeb35c0918a08
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:1afed5cdbf153c2cc0591ea45d6836bb6a2c5c720f3d29013784cbe4382c4227 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:1a6955e51370225f697d61f9ec354faae2f904bba4e03a5b72e5c753f07cc1af |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:f577a571d6857e66575b8bf1fa7a0f6feab7488bd3a053572b4151a08ef85244 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:f76173ccc868edaecc84f310711acec95a16db646e82abcb76dba7772fa5c5f4 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:aa22dac5049dc336647021184dea0ce4860c9baf1b3cfa73b76b94a537ee868b |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:4b9d7894c891fcf052d7f945af12733293833ff7610c7ceffc12df8405531345 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:9581661de73b34ccea9e7046dfa353b8e32f9ba70005b0c1c60b45cc4b5847c7 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:006199f92c1cdab447ac0e3b780afd62fe0e53a683a22cd887af0681fb89d609 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:6fcb01098ee6ef0c4b1e2bf1b73f5dce9300b9aa6edb719fb6c5e4d8987055a0 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:05bf9f23719167ecd3b3e9312637d18e64249b92d9837cee5de9a0b2365d19fe |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:49e0b3186cac31e58f77e2ad0fe8dd920ec1da82b2c59ccd4a7470aa7336cfc6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:7597910846c1167b66d4d192856d03a46b5a04785c92a7f4c7d51fa561648629 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:bf2dac3c493bb63b77fe769ef1ae77fd6e3d63a0c1070f53688a3ad55a68f9b7 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:ccd6ae3079ca3640d7b7657d75fc7f2b7aec2398dc275c64f018f18ff4279db6 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:15e52fb8feff5344b352325f00505484aca0e43f48acf355e6ca16e0dd2ab47b |