dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips, dev)
1.27-debian-fips-dev, 1.27-debian13-fips-dev, 1.27-fips-dev, 1.27.4-debian-fips-dev, 1.27.4-debian13-fips-dev, 1.27.4-fips-dev
sha256:7af4899908da15867ccb7e43ba67bdb41dacaa6b09e617d87caef768b16e4aea
Manifest digest:sha256:b6d21464ff754f59fb85608bacb50ec4182cb26d129111cee16582091029e564
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:2285718f80f784bb90cfdfa12584a618556a2d6e05068559157d68ce1e939d9a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:b7403bed6b53e1b73722aaa6f2abf85d3394fe6733c1accd8b09a0006551d74a |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:1a7b6e9a4b02cafa8917a42420837b7d8d14d32d07646585ad0273604f670dec |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:96125b719b02af395311988735274f81b6c2473dd39e708272b8027f5007be21 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:4595dd0403d728f8a94a49562f6b4390817f93243ed7aaf54582d8e4b4326522 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:dae89ac8f59498e380dfc425541395346d7ae5ecc374b7ef9c886b7bdfd296ee |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:d70879d884c60689016bf719ca876d0d80e27a13431fe1b457034d9e0c033ccc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:0a40eb3d91961d36977fd6c89e572dd34992a57e61401670dcdbca1d5e26a379 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:5c3ff88e158dcc803b9a374c8457c93a247e0768bdf9126d1d8e1a989093db46 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:48d0f84eb08e683d4a2e77038b1e613984e765ec1f84fe94515b50c9b5312b21 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:b0c19d356ea610b882947f773b632eef1db5ff26625e754c44dc460016c8dd26 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:62c0e1800f3a91926d3e7730dc7762147d6c38b72386abdbeb31f1ab76a6c294 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:beb6adaac7a810257bf4f634d92c06703892e825fc6f7368ce359452cfe0b2e8 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:4849b9000031fa0e3da49773ead89e43764fc5adb732504148fdd7d6deeb37c6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:17714babdc81624844cf4483bb5f09f3e2fe6c7dd42de8082880834cdd58917d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:e2205e26a2a7b9b9bfacf64bcf54707069b578e96015832ebd597481f3b506be |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:ea9649f64a33e5379696edd77f92624bd47e8465d2b52492f30c2e03a1ed6ecb |