dhi.io/cloudnative-pg
CloudNativePG 1.27.x
1.27, 1.27-debian, 1.27-debian13, 1.27.4, 1.27.4-debian, 1.27.4-debian13
sha256:6772e8466496a00ba09a3b878ad736f27ec64d8e083bc2da0495c899c7461bbd
Manifest digest:sha256:cdac7aa613750fd5fa4e90d1994d47a9f6783a80bcd1c6aa934021aadd8a357d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.272. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:08c171187360f7614eb613520215f2b36d1e5653bea4704bcb0a7a63e0ca8c76 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:25de7b257872fc76a282020907d0c62fc77c5de90c5e782fab420ff3bba85ac2 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:48da8503f367200e086da7d099528f4ece5795df6e97eed30db93e32b6fac004 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:fe13445591cdd9a34c3676b43524d7b493ed7ac44485551e37d84d95ec532b42 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:ab4cef4935461c8c8510df904e2c1efab4280d375b663a0a6a16f94ee2a9d827 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:b355c3cef8d7d5d20aa3b0a39ac8536ec5eeed0a30c597e1f75207c9594262aa |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:18535fb06b5ee351b7b032ef4bf5bb3babded71264892c8143e8a7a3b77e5c9b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:fc307e52cc50acb6b8080555f72faf77e586d505de19a764f446ffe92f86611f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:485842cd1c1663f4478482719eee0d4b70b1ccf510f14b9330f8b0c13bf0cbfa |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:f5bd29a24a87810a89dc3c73198663737c9005556209575446d27cad7b6cdc34 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:bc97a637177ce37e9652cfe82a79f5c503b3145f50a12f33b42065f39056ba23 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:3228f845b924090b5ff9a0ea476b23a5ff8791883196edf3d0ae44b402eb5c1d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:9e0f2be37f76fa1698e98d8b89ff8e3eb3ddde1bfae033191fe942e1eabc3350 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:5f213bf262bb6205947ee073be223ddddd0aec9debc66d96daab9a226e332606 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:79e9164acc52f604bb28482682e5df077c6127d8a908ab9724a70bf1bd92c91c |