dhi.io/cloudnative-pg
CloudNativePG 1.27.x (dev)
1.27-debian-dev, 1.27-debian13-dev, 1.27-dev, 1.27.4-debian-dev, 1.27.4-debian13-dev, 1.27.4-dev
sha256:c89cd59827de4ddf021fa71d1af4c9979914c134a89368fa3c66e00f6162d90e
Manifest digest:sha256:fc654a95faadcaf13e7a9dd2f9ea57d696d026ab961951c2e794cca0741ef063
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:c63f522a1d9c47e50460c375dbac35730f2f0d0050f1aaac5da76acbf5e8179a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:f6141e961e8d6204180fbd4da08c60cdcecf074097c497549c6ed8696c0aa03f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:05eda865417ddea5d125d74d5980dd269333313b1e71d94075e576a799f63128 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:ad9c06327e66e58002e358415229442b7b11398d6c55d218f941c27edc8b7fd3 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:266e362d7beb053815a41e0349528b080d7dea4eecb84c1166c5ecf62b861660 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:2818388c288530ccd1a8a9447353dacb223e62414da2c5afb40e59a661e0cdc0 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:123fefacd55127d541f9f69a139147474040b9dcfa42080bdb227c885f1e5bf0 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:c24d89e6cc540843dbf1542d96a2f20d7d6c37d6791504e52fdbabcb943d7e53 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:8f86de78308cbc1a0b068922c6e2f6a9ae1b20cdd9a43eb51303e0c32e1f9bd6 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:9580807acc69f6aa39d37a9fb590c0172e139a804d3f8b60c572b96a00fac1e0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:f0582bcf5d6d9d7bbcb1ccc593257108e9f0c4df36c2f7b147d3cb4c0c811890 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:652a8ee178142274ba9b0bff5368c881debc635c7482201d01533a7d42a1f0ca |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:5ac3e38c25a3d1ec470d01ce04b0fab225f1b1afce789cb8f507ea77e6aea781 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:3b34a2075c8f68e756dc5d69ac39b3e374d9ad95e5b2b8a6e340259dc5466bed |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:53e07f854ae07e246beea45226bb2994d4418c581af4fc1dbdc5fe14ca6bdd86 |