dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips, dev)
1.27-debian-fips-dev, 1.27-debian13-fips-dev, 1.27-fips-dev, 1.27.4-debian-fips-dev, 1.27.4-debian13-fips-dev, 1.27.4-fips-dev
sha256:4bb2dd08ad50e85ff381e6853d95b7fe918852686d7bc1d3165773bcc44a18dd
Manifest digest:sha256:4c2d32f96c293e271feebc02738ed0b0f11f9d2ff5f34279fce53a8ff2930741
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:e935eb17fa48061300a1bce3332ceb2cae2ffc5abada057b4d569aefc396f710 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:dc2b1fd8403fa29aa5ba42cec887fc51580d6118d504e3e2aca7d299d594ff08 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:47a5473c3aad49572bb00102578beb82529ee87e97f555e4f42fe22fc6453fa4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:d624cfb618746cac033ac8f196ab5528b7787e66cd2e8c1dc7b0df663c120040 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:4c8096df55a8caa4a5950a4a5b3e8ab2dee66f2e2ad1e0cb9ceaba880dd565fc |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:796916e557a48b572b4c6a923f82c54c9c2bbb460ea8b0b8e4c53d8ec7b61729 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:2e765994ec184f539a2b5dab9173bc98eeb4e536b923ff986156c921aca29a4a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:8ce72596e47595ca56c9010fb415e69d3fb5fa04a5417ef1645ea19e73539f00 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:35a316574a8a438256907b6b6c38df2d05a6429598518b75f354b08d3c0359c0 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:6b8d7495f204e1f45ddad456a20a0095523aa754689f57c7a14d45913c37bcc8 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:58bbca8cf4a8772797498479b059b3441582b792f5f00a9f5f53e9503d2e4b74 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:f11e5bae2c9560b31f843c34ac8ef57fc36f971c606986c5e0298a831afb1fd5 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:47d02d62ae00d1b59b449b52e5a7fae127252aa34b83ba775c8617316186c7e0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:8fef1dd1ecee06f8640ce576e209f1ead0fd79260569469dc84aff0fa59a552e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:d2583eab566a55c7a041565ca4bcd8b6399730a7b922685ce841839d974698e1 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:12ed2ed941461d6dc29375cd487f5ea3241e9ace534475e3e1369901336a7092 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:a45f75631c1bb070c84f45970e5546253bf9c97dd2dca20751870e997388b870 |