dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips)
1.27-debian-fips, 1.27-debian13-fips, 1.27-fips, 1.27.4-debian-fips, 1.27.4-debian13-fips, 1.27.4-fips
sha256:c8f003b6fe1ab8c93c6b3fe845b9ed473a45430bd356bcc6aa230dff7c33799e
Manifest digest:sha256:2ac8952871a3adafe2c26ea5cf7150d8910fed0562c55d5a798f268c088c8d18
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:ff30b4e4d0ec128d61fcb51eb95927face96a21add7f6695525ebc06350129b7 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:eef7fb2dc680870fe43b80254fdd22d848f3267af185c06188732e76e20212e1 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:8aca0a3b207993bdd960dbc1bf57e4e73eb0f693da4ac0d0330906c4fb5bd744 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:f9917aebb52e69fc02ca56bcf6db6d54783fd101597d3b43500cb6ead6638d69 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:e93a3c3adb447313be6b3d4490ce6921dcbcaa39ac5982da35fd6684beaffdd8 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:64cb533113b3de3df0802e779f3acf42abfec3a919e62b5d5482963e13c7a62d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:966312c5844b254a56f1ace022b2b04229296c4d59a5a07e93bf91a619708692 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:b2ca9b1b8b314f79e851b00e445da13c540e745bd758cc878588fa05cd14fdbd |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:f4442c9847550d8da311fed4aec3ebac0270306a0add64fd8fe503969cc6f6a6 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:871abf469b42bc23bd9444d0ca895b4fefb630cca729531add2841b710f1c948 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:5558f438fcadd05b0e504e33bdb0a8a111e418003aee1026e6107d98cd32d1f9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:c0305a98f6aae32aa96d49928ed4081ef2291626a294ce5b2f5c2f7482aabb6c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:d213b9d6a1b757f260e44b361b94c63bede507b0f00049f5ad70f3cf91594a86 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:8a583862a3bb7307024847821e6e40e8b1af43751901e5050e648d11f1c366e4 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:3bae3853d0abb6ed8b8796612bac9bbbab271221a37195cc8af0618c7b9f9602 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:02565fe41e32035336d1f0924aa612045957e80571ad99ada3c2bc92180ebcf2 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:2e813f00b3f66418fd2a57a978375d4819f65d35e93c863cf0b14a6218896260 |