dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips, dev)
1.27-debian-fips-dev, 1.27-debian13-fips-dev, 1.27-fips-dev, 1.27.4-debian-fips-dev, 1.27.4-debian13-fips-dev, 1.27.4-fips-dev
sha256:542e27f0b67f24fccc30b86ffd2e6db3e59d4d363262769e78b6b0ee57cc4277
Manifest digest:sha256:0090178e3ff52820092e93314f7a781fbcf6b71a75554e8c9b78c2dbb8768b36
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:2ad6d5dc688a9ef328647506de196c158b716ef92c22a02a9cd9663ee6093b13 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:2d7e91cea9c2d4009ab5242407008463b2840cc697f07bf9390da42493239ff2 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:e27b07f247357274316491929dc4b19dfca99f4f3a93731b1ecdbfcf676e85b4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:b5576d689e894b400a8841dea37a3feb52a02584c801acd711f23fe17cf97b2a |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:ffa729412db8d63ca4753a2cb4d8c6499896cd454f7b0da7f06e37cbd8fa159d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:2bc1e631370c38c91749e07f23718639aefdc384374ea67e92f8bf04452ec8e6 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:1294df9d9b01ce202bbb03068727366c5187c253adb19ce36792b396f1d3e520 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:3bed5b7b6214ea485c5f495614900135f8dbceec02ed3be42f6aab8bf46a1665 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:c8477048d2d0059cdcbbad1f36b1df2c08fb6c708a185be0cf562c75c3308526 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:359c322bd0083a7ca35718be447e0237692f24a97bbc157c7eb7b77911104143 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:357e88ae59c700b4979edd18e5e43afd96c021f567da6496e96a5d54c70dbafc |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:0f2f5b4b7b04686e5e2d7c9b239f81caa415f45b767fa50e4988ccfadb6bc9a4 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:a51597b274e6eba41ab7868ea135a47d9a662b9a3518088b4995daabf1e8987a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:51fa7ac25513991f95501fbad5415e1b87ef10f18a3b0810293503d9d67aba8a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:c6a130554ab7a2989d4d94527048fe388b64d32e6cfa314c22efb9b910c303f6 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:f0b4ba677185e2599c1b8a110d9f43c8733ced1b3246b375d0006b1967e0a23e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:03d1bc5f085884703af322109aafebe4aed489e19de8da425d58975d83269dd4 |