dhi.io/cloudnative-pg
CloudNativePG 1.28.x (dev)
1.28-debian-dev, 1.28-debian13-dev, 1.28-dev, 1.28.4-debian-dev, 1.28.4-debian13-dev, 1.28.4-dev
sha256:0956304e25c61bdfdbfeebda3dd9d69bd1712d7d454134fb87aeada2e8e44439
Manifest digest:sha256:c083145ce9da8e01876956ca246d1781cdee7c4e978387cdf8621cb4ee441599
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:2def58526e22bc893db646c216c45389ece4134016e43752cbf89fb693ea2bae |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:b071e087a4d8331500260269dffef3cb637b821e456753fe8d8d5b47a2c1a958 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:a83c6a6940b3d9f78e831dec9708b825e3fcfa18409472464af89f68bc2198b7 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:68034492d22f6713f002a601f725ddae9d3a7120894c914e7b1b84a38ede68cf |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:a23b483b83f606474e1f66664def48ac0d83e319b9ac798e7ae83bed79c4c06a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:9a337a6a6b31a4dc112304db61f1c66cc9f154467f83fc0d7ec947b70e19ba95 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:03b220457619bffb22e4820ee957965bf2a72773bbf02e498ad48c7569535c20 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:77a772bdf31bbdb36e8e7c096aaed2ff327674c26191ae2bfad36365e38c2d20 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:4a158faf0497efef62863db1be8dd04f8ca90aeb75ef051018655a8e89918711 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:5fd24a62f0e18709fc11b073ad27863266f5c75e51284cdd415262ad8bf2dafe |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:cbd3d0a70d574be2fc12b72ea7ebbb59f9709fb215d37dff213d0c2824834868 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:e5cd4bf8700d28c2cbaa4a38847dbb82f45a930d812efeab45ecdb4080ca0fd5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:1bc5f67352bada9f2e0dd6706744a4e48446b2b35113352f8cab8e223fc26153 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:73e0cc6c1544111dcff9a3afc6b173be18aa1d260c098faa6b6fad0f2c1380c4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:28871bcb2dc768bdb7ef5f82e3a26662ee5f528508fc05fb12a3502c91b57a73 |