dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips, dev)
1.27-debian-fips-dev, 1.27-debian13-fips-dev, 1.27-fips-dev, 1.27.4-debian-fips-dev, 1.27.4-debian13-fips-dev, 1.27.4-fips-dev
sha256:9a49e4bc999e64a16a1b4d737915d7f82b1e0a129f549d599d71c1f7df3f6642
Manifest digest:sha256:a2baf8a711fbe09b064bb3d3aedbe2f49aa9a6e6c97e3e4d13afc03084bf65c1
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:7ef0e56609c9ac6134ebb9fa5ed5a00451883b63f1aa239141ceb3aaaf77b03d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:7cb4cff005dc2f354c02f62a899d28201fbfd899e7fb1cb10fd35b03e3b06c56 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:224321923e9aa7b1c272dab7b8713887c4a58acea7f51431ff170ea9b3c1b4ae |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:744ac0f1e53ff8499f65288159a656da054404dd79f270c49e89315ea30cd79a |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:7ea787e56017a0fa266885ed953ff21df74669048fb73dea582aaa8ecb4d0615 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:4e0bd6737632c29d58c341ba314928ea10716b64e0ff30915b9db976c16635de |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:1d6e052124cfbdf81dd5489d2b3bc097bcc4442f6983030edbcb48bba72141a1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:23ec02e4b832eb505e63822181c531414c21dc83b193a73448c38d747c711094 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:a51ce9bf8e118f15fb3d4733181bbde2dab3ab9f270f84622b10aa349e4d9c5f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:91e2f43d2b72e53992801ca0ee432e34ba6d01c6618294aa23177f49e7d815f5 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:78ba8ec6df704f6fe85e01daacd039b998a6f021a2c0dba6a7178fd0ae2fc1f2 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:923b78af0e824ae7c370bc7f287f1e3d37ecb0c1e46b9593f79caf5f0ceb5181 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:be936795f28aa048e6b7ecf066ef52126cd55cfc2cfec90f52eb87080061c82c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:560fba59d9dc4c868c826c0a43131e33ac6d41b47736a156870b2fb58d7e8c45 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:c784b9fd17436bdab39d232364ae5b91cde7aedc8528e69e8e21df27708fe380 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:00515011215ae0054326ad8f819a69d40f14e649317333a7367262e67cc24c12 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:3557a54ad9a1e9a327461f88a4b38233cbf7eea3a04bd6bce4ba562722945d75 |