dhi.io/cloudnative-pg
CloudNativePG 1.28.x (fips, dev)
1.28-debian-fips-dev, 1.28-debian13-fips-dev, 1.28-fips-dev, 1.28.4-debian-fips-dev, 1.28.4-debian13-fips-dev, 1.28.4-fips-dev
sha256:845fd7e082056ef2443e6a9b61f0baaf8da614e264150ffb32135aaad060d494
Manifest digest:sha256:00264a602130b9f763da7b45b3f04e98c968646441ed33f104b809d7eee19578
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:8b3303a5fb441e7faa6bc162647afec7fa6ff424930e0f87bff71adc386f0d67 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:d1202002ae1366233579acbc7f13f990fba1b3e01524f447ce6269920547c5d0 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:086c0ab38abb835c58c9ea0e4833772ae7bd145f606cb294246a43344dbe175f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:aae3cd3347b1eee98f0460223999526c84792fc3bc9bfec0c147f843f97ef09f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:a9fabbe49ae4b14b885c4ac6c0d0b9756a44e4fafe9ef561b8704265893a6c5e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:9c559695f1124e34920edc150b706e9a0fe6f2ba99fea6f2d043212e9d100dcb |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:a9a2bbf21c927d425d97d3c5065fc4b84c320937750f19ef40afaf50ec1ec27f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:7a10e13637688b7e87c1b90371ef78e42b973765d2e69a68db9400e51c3f7686 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:764f492f73590f4c23cf6a6342c3d46cd7ec425c30ffb4c2d552afd0fa9f254a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:411e5a0ea12c2e5a47e726c76f593a48f93fec3d7a714b67ab68dedac095dc92 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:517ab5241e1c6fdf934e1016c8386206348c52204bda5c42cb19358c4c66359e |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:bd3c2d6b24886b879ebfb663c3b992ece2384885d1505ab6631de0e86fec25d8 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:8f968e1b26e21a5b1a356dbdc23a54ea8e2e139b05150faa7ea199a356d9a003 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:498c0ec97747b79ee10dcb1244316c1ad6c1484147f9e60598b783fd83867ef8 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:60407431348cb3f615fa33e03a31dfb249ce52fab347617b47d6c076e96279a9 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:bb2f532babfda11f787517691c80d8afd3d87886c9d444e75dfdb4b776f2cc87 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:1bdcc22aa34cb6acbf37c9f527fe1351bf4e9bc81e85aee3bc7252a8dc20c917 |