dhi.io/cloudnative-pg
CloudNativePG 1.27.x (dev)
1.27-debian-dev, 1.27-debian13-dev, 1.27-dev, 1.27.4-debian-dev, 1.27.4-debian13-dev, 1.27.4-dev
sha256:f2a0c0bfc8ed5e8a7b104d4453580e46f9b0acdd1abe11b0f801e526d8a4825c
Manifest digest:sha256:ffe990707c9c7c12b6a671bdb2bdf4c4980ab9167cd76ad90e9d1441dc6e7f81
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:5f4eaf8b67f62659abf502060c6abee0fada2aa411c65ce841461819dd8c9f33 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:08075d6c5360ed0878bc1e49d64084041a08cf3ec31b6a7d11b243d519270754 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:9a1b59b814f81e75c7269f9942c9177e70ca7ab7481d07c66424aa6738d21be9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:532f21333f39567cc2890057919a9ad3786691a95e69a8ca8748bca36bc30af3 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:fc4f2975974afb7c93d0c50979a77951267246ba09aad9fd9b83251f170f43f4 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:9dcf3e395b7c96aad863bb952df404df977c385bcfec325a1e00d6e3b7b762be |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:03a9e3e83d0c5f3c384d32f4ab132a4d146e1a2449c6db4b7584589698ee7f9a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:267e87eed9e9884b487ff4bb2e1335e3e1c36688d48d09cf39774d84514bb23f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:2ce32e60ce5ece6a34d8850d29b3058f3cd456f3c16e6ce748ba1c7509e5fa81 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:0fff55bc0b1a2154652266e64cf9f04c71ec6256469b1646df0d4e8004a2f2a9 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:d54d6533e58220ab8c1729dc666e0aa77c86b84c69c65916802fae69ea9d3bc1 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:5a0a5dfcb545b501f1682a69586eff8599fd117571383d5091cd90e2d21df326 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:df2c689f586606eed2347701a3bd2c0ef9b53727fcdab318d7e0cc8cae91b206 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:048fb88fcc767026c92db75dc2730534dc26519b2b657d3770979b2fe2f535c4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:8cf159eb9fedd6aad46493fc877e8eb8ba44081e48f256e8d7e02fbf3bf38efb |