dhi.io/cloudnative-pg
CloudNativePG 1.28.x (dev)
1.28-debian-dev, 1.28-debian13-dev, 1.28-dev, 1.28.4-debian-dev, 1.28.4-debian13-dev, 1.28.4-dev
sha256:0c570bfdc3e1e0bec7aca3db102eeb4a36ea848f5d7e45db1589f67d99fb58b1
Manifest digest:sha256:3a33fefd57124cf4b1618981d835d4e0306bbc043287594099295dffbd3bb63c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:1a9e88126be7d870c1c418bf9b3d8a1043cb4f45fc112150a21e3888548110b6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:eb4f408f94858c47c8544e82c70ee5773e8c6e4034276ffe3f42d180f5eb875a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:138be156f234723ac6fac11425198287d1db7f201c5e1aa7949930ec6a3d98f0 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:7d61f92194903ede82d07ea0aa83d3c145979576aa44d13b2150f7e25907df69 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:c1efb8e47bdc66f681d702dd5d84593cb5952f851019a494c2ab76698ed63d92 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:cbe04fb6bf4b9e05af757f6afc1887c882ed4956317c8f845ec6df828173703b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:d176fc3033608e19e1fa99732448e23571b200732bc6f288afe8b2367bf9dded |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:34354c944fc49d12976ab22ddc49c56d3be9d0299318a77fe3b26d21c9eb808b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:64b486124f599f2a2cfa80e4af05cb4b0e4c4c01096dd63274099a38194bb7ac |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:58dac74a1e60e22417bffefefda116a35867b052d50b581cc369dfee4419bad9 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:498f148c118e8006bc4c3ac273643b6b11c79976743ef37e78792fe9f7cb18f2 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:14f2b123fee8826ad9395262f9c01b076e96f244ca7400b0393575433eba9d2f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:7e01248a77ce7e02e6019e9172b21e13e48a26beb4311b95532c66c2ec948239 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:6ba26ce871f8fdeb9843e1938a201fba4a10a6c4e6509d68568588cd8a5a391f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:21bd64f2fc3bdcd64aa076b290b9f13d6661ca2651fe91ac633e05434a105da3 |