dhi.io/cloudnative-pg
CloudNativePG 1.28.x (dev)
1.28-debian-dev, 1.28-debian13-dev, 1.28-dev, 1.28.4-debian-dev, 1.28.4-debian13-dev, 1.28.4-dev
sha256:de9ab314d1ba9300da7aafce37475a6f958a557ad2b92cf93ac7ca237367acdd
Manifest digest:sha256:f0fd7ecbecd9bbd9f7149d594e7d637797692b5a1170799b0eecf5951074d69b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:983a93e075f1d8706df9596bf3b805fadd335b83d1f1c7160af38da107b97be7 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:8e7128cc4a1e52623493477129eaae973c1868d0793df4ac6e9211abef2dd50b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:9d887a9d48abbb2c7a00c2534718e683cd226881cc61517035518ef3a88dc4d8 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:68c7ce6b367478cc6ca9b62b4586685c15d944eb956e397be15175efa9719730 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:3a9f44cdbcc7d6f32f7116e31e6242ac4178ac976ad8b0324979cfc9ed655a86 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:d9b66405e8bf298cf4156d3685fd99e0dff519002192c9c67daf4f22311a6e9a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:5924143c7a0b226ed2bc390a45b559a11c666b88267c322fc822777fb31d0c16 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:ef2335c2036212ceac86765df9a90a9496974232ac785e57ed1d0ac6d47024f2 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:4adb2811d83dbba8a99e06f40236de7d18aae9db34f9e877a14b632b6e54a8c3 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:5cc10913e897c17bc318dce2a02860f025506be0c602fc944c25eeb8a1d50c3a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:80664c737291bf83be61fb32c9897da08c2a5bb5cc63435141cae91f9ff0087b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:53c49e7fffcb819189b4177b7ea85746a9cbe53b5c56c1ed4e784f91d9b41a8d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:dad76c67e2ce30b496a32e9f5e4b21f64b1d572a3b3a5b2c3208ba27a42a2850 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:76e148bd3d9ed9c752ed73bc20c79a4a1940364acef613bf0a21f63024306b16 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:7be766c3c3480a45e5150a08abb5f84a2a63be6decfafa3c19c28e17bbb73dc8 |