dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips, dev)
1.27-debian-fips-dev, 1.27-debian13-fips-dev, 1.27-fips-dev, 1.27.4-debian-fips-dev, 1.27.4-debian13-fips-dev, 1.27.4-fips-dev
sha256:56f975dd8013d009f2604eff242300d46b70e277b40ff87dbe3c7150ea4783ed
Manifest digest:sha256:21c610930b03f0938f77e8b1d7ad6f360b2334d86b30559d3d7e0a4f27f7cce7
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:3d04400705cbca785bb9bbff141d12f4968f559b25d5e8f56a651cda05559d0f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:f7aebb131a641811bc36b104ececd0b92a65592df5e65b9e77b9e2aadffc0db8 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:317143abef3bbad345a7a84864caf32b28d87c4ceb3db3c367ecd93cd54e94da |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:3bc00b3c492cc976e97228a55a0e473c30b74c7e3e6052138fe798ec17a7f38d |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:3d40bc11d98b24109fcb23a518685b2e4c2c46755bdeddc1f7a1a5cdb49d6015 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:9c559da325a449caf47f8caf2c56a9cbc407622d08f497ba189f015a0baa2878 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:a1bfc34d3f7f46e2412b8fda14558305204cd6dfb403e222bd05ccec03e15932 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:68f6c6b4a7039fac186d437b699a926b70d74932a3efe86a78b192366ee4ed84 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:0593d53bbb61219a7706a9927b9cf189ba60f39382707027e8c9cbfd9c4d8157 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:6c363ecfe5ac38c4450898ba7ca8bc701d6095f6352db70363991bfa8e27dd6f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:ada564a28c2b5d6486f2d4b0493fe934ea9e8eafc0b5704a6459fcd628d1d8ca |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:64f630121493dfad8541aa5a4f77f0d8a69365c1eaa78be1d3e0d8d77a8324df |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:5ae194f81aa964eedca0ec0d2b083d58dee1ffc0b316cfb0dbd9299c1158c842 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:3bd09e42606e5fd07b28638a66dd64c0781152f7f5e13cf94408e6efd2b7d791 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:7fbcb76a8f96b3cee377855b4939c9073ad9ba1c92c9b23a868afa8905df3930 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:7d7306aa6ab8993c679a4700fe54dd04cf06ade9528897f6df6235b769e1c739 |