dhi.io/cloudnative-pg
CloudNativePG 1.27.x
1.27, 1.27-debian, 1.27-debian13, 1.27.4, 1.27.4-debian, 1.27.4-debian13
sha256:72166963e24a48a01e14762dbe5f7ddb853827869a0f21a263ee2d00435cab1f
Manifest digest:sha256:d53a1d0bef168eb621e9e1fedcf10ca944ed82aeb204183c2626a8933539fa05
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.272. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:a98917c7c731954aa6280833fc0d9044aaac16324f7400b99c0b15b329c1db06 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:ff8956c891f0b2d37392c58b5d5189b84233486d70d7c5cf92d08c6254824371 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:49be98fa76e4ccdba432b930216cb434dda6759710e84db112e976fe89b3cc81 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:af2f8578838b7251b1ac0897e27bdcb8f4634b174652c8a31c46b066f0a44e44 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:2a4aff6b4c8a2617c515c4bf877525385714cb45e6850a0abe752ac6c30761e9 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:7073ff40c30a06e3be9383c60fa627d8745482dd796add17ee5cf02ea65e1fdb |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:79d3eaf2443efba2c85adca96ccb6c11be97194b511567048ec0b73a8ef5517e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:8998e49d13fe03777f07c5872dac92b94a52dcf174af454bd3c5d97568bef442 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:6d09d68a592b3b66a66d91df79d60fa1c03abeaa971125e0e6bc2a1ff50f7366 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:57933ea06870e9d3606d93953a6b34131c293bc690cd1b5f739f770c35a46153 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:49e678fc1aff6b168b5cd887e3ee927a35626e7a4edf7665ada8a60547a8cd4e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:4f589eb1a5355598914f1bb88beaf3add55868500f8b05df82a0105d0d42f1a7 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:45dee5c2288968ae071aa5a2ad7dcfedad08fa60f7113dec138721b4ee26b98f |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:ceeb40f38a999e180d8b7ba573a032ba5eecf95135db5e521f509ace28ccb92f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:5ae9294f6c74e43be515fc0d7aafcf03dddd02773be08f2f6bee8a87dcac3e9f |