dhi.io/cloudnative-pg
CloudNativePG 1.28.x
1.28, 1.28-debian, 1.28-debian13, 1.28.4, 1.28.4-debian, 1.28.4-debian13
sha256:9e73d3f0c9bdcfd947c16652e0be4dd972e83de592133272f9158900127bd326
Manifest digest:sha256:5fdca25cc9c4c8ed34b7ec6fd96c02db42d541634c0508f860db0e8a326c2f01
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.282. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:cb99a684ba3c8b5e281d6ec708369e0c53d6ce551a483dbcd9a8a53b189a4873 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:14f5d0d4fcfecd3bffd946fee58ffcdba004dc95a46e1f2e7b4488c3cfa2ecde |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:e2c45fe2371e5dc2a397a1fe030e7c8a335610f2ccf1d362ae80c0f729263b63 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:63ef732135986df1ba1132ff91f5cbc9a3596c320b9efda4fb2743f8aec7ab00 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:ccd2881ec1a28d98172b6b18eaee43bfe01df3e02a5fc3aa2a2f41c5be3da981 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:2942300d44962336b7ac5ebdca9549bcd8d4db4e83a8c23f021250c3c8ac783f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:46746ba70e2b9eda228220010888d478125d03d04cd5bc0956e9edbda1cb3dce |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:954cb6dceaa7d9e622e20da6bed876f10d45dc6f36849c01a459535ec231244a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:b130d11e965d05155e2cfc8452aa78e0dab855c1e80368025a75c719e5d3c9bf |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:2409a061e722674f3c75a27bafaa1bbe151c02c5aa50b7b00b76f9f1c5a72778 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:4824355e12a5f6d2ac184c304a7be7c53eced9a944474d513d25c4255a79a972 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:5f9926aa960bacee5dffac9fc5fb4002cfbb5e3544f269c24c494373e16258bf |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:ace9af9ff27941815aa3160604f2a5118d2751eab25db48cd31cad54c430feb4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:f7b7b9ad4c90cc415a665bc0cd069dae968e4557d0cccc7aa7db4da8a2f93cb6 |