dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips)
1.27-debian-fips, 1.27-debian13-fips, 1.27-fips, 1.27.4-debian-fips, 1.27.4-debian13-fips, 1.27.4-fips
sha256:3a107445db1fcc3962a2d49025851a405f3b2c562fe37a9bd88bd4e71f3f492e
Manifest digest:sha256:2f2e1662d3b6fd0f56779a4e176d2e2f5f70bc731491d599ceb398e5d528faa3
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:a0ce958b5adb28b7316b83a0b5387aaa1895d05a5502d1930d69ee197a4202ea |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:85d2a6e25cdf7182f9bd0bbaab56222f390b22a2f59e71847fb054abdb0ab2bf |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:2151efd1496e3a1295fb136f312822cda8206b574cda54226251f31eb32392db |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:081cd369c23ea83d312ddf37aeb4defbc76dd389da0239186206e8d892bcc1d2 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:a313391567024f426bd3360f3ab2d802c01a29fa9266326304fcba804893094b |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:8f8ae2243676c6a592bba24b3b1428db68f79d7226b08f3e9d5a2e032a10985b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:3a3b73c2e6bbc901adf241a735d40b9ec1bf2c8588d4d7250509c87768d0fd18 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:30ce1f00d96948d027c3fe6a53984dfb460dfae19dc298eec134012d8874b056 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:0a97a5d6c56a683ca481ac1c109d02ee585240348247f019f469db133a733a6f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:cd730998ecf5e64b2bc85ec6bbd39af319d02688d4088a214bd44d0d0f84234d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:5401b5be6e5a37076d9ba856b6257797684c8f1f8f370af5ee29017a5f30c88a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:fd842101ad068a15fa52ae55d0977997e44ab1e2b95b79be880e32bc716c4ab3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:ef850c956338f1ed7bc6aa287511fd0d3609bb36bac87279f3af9c57e19f133a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:ca85739c714a8345cb67f35552f09ea122803c7964dc57e8b712c895dea2fed6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:1393cfff158ec1f896c2884a6349e6a569d590b2e84c90cc3ff2fde423cb1d95 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:4da9269b272c8b0e0f2bbc67148666a3b6c46d151d3292a9db250d23bb542c8e |