dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips)
1.27-debian-fips, 1.27-debian13-fips, 1.27-fips, 1.27.4-debian-fips, 1.27.4-debian13-fips, 1.27.4-fips
sha256:e24f33f2ea0e8924cadf5d0c6ce681deded86c3dc52bfea6012bacb68bc2bde9
Manifest digest:sha256:f4cd108c84fda6bb03cfec0bfc9edbafd5f8043e9bac8f2a2191d55d996b6913
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:d932b01edb1761c6f367f2ccca19e517a02cc8a3cc4a24438d9ce489fd344e37 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:c9178e60bd0067a5009bd42aaaa0c9ffe9f5b7ad22b14b667b7fedbe09591ec9 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:f09e5b4565a498f6a8e5e88bc74c0f0e8d9b684047c726d9b939cd5917a8e83b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:e92ecb2d2c372cde6e805f0d370ef7be06c26b49b7718e28c34b09bb0babc170 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:1a0d78719dd8c6ab77a93774945827887d41359ca69ac7ac8f4f534dc599a0dd |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:7dc3291c3f39c8e519d9c4c39e31289428379a652db6fd8ec5f72ed7d265416b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:26e3349cb2d86cc5b94646b346daebee4a343a6464a497477bbd1dd0a3f6f39d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:76d355c721d6c32c9633aaf34cc0dbf247e93b0be52afa197f3de6ba37b6a518 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:ac44414a9c6689828ae8db888eec71059e9326ec10f34288d0d3857ee06b0e45 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:9e9d3269c1642ca58962f61ba790cb6698a1d52c3b4f6a075cfeeda0db1e230d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:d08f11da59eb694a093af57c83e42b9e8730ba913690f18ed39f8d7af28bc46a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:7fd87fe00b363c748e0c7e9467f4614064235e61e1a1fec751194c5d1ea917fc |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:3cc3ae62758690843e48dab48cc053f651623c1551c1d204fd8839cf4c62301b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:258722e8f48f1b3701025ca39cc6778a57df10b4cc115f5f517d2d00081ee8c7 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:126e0b5c10de1a7d818a96ed715733054a7bf325d4898a01b632cce0e69be9d7 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:db4565d06c394049894118f57f971a48cf9f7a7fbca4c6c97c0fafa36e408db3 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:46cfb202fe2ed2dfa40aba12634a15a3e1f627e6c1a72b9de6b464f15ac8ce0a |