dhi.io/cloudnative-pg
CloudNativePG 1.28.x
1.28, 1.28-debian, 1.28-debian13, 1.28.4, 1.28.4-debian, 1.28.4-debian13
sha256:b16693d144788aa2e700e289a2a62a409e334813fda91dede486661c5425ff0b
Manifest digest:sha256:8b432430add59fbec63a9d2c08f7ba4059dafdd4721dd328651e174cb3b5d3dd
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.282. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:12a21dbd563b7627696eb4883b95bd3675db96acf7436b01e888c30c8807809a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:86013cacd632b557949129278a01f691f8d0ac3710643117d65f3a3c609aa552 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:a2e363101756f5794573df6c0fc4e3a74c756df021595e1b672efaad83fa5a3f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:657a24252d259e1c5e3c1424441658a42799cc728cced6a77afc465a5ebef90e |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:cbe5579ec4d0c3dd41c16681cc4e5fe89ec1384e909980ea61e3bbb9388cfa5f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:6ab9fb6500042dd29f6dbb0279b0a6946ef84cf755c800c66017b13385f96c45 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:54b026f0e127763163ee464320486f2f334aa5ef21eeff028abefb60df70b3ee |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:ba5a753397b68daf78fd9366eb756727c160a546bdef252487f7dc7384c0c2c6 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:9582b39f131b5c2a563ef12cedf9b8245e4b5346f1b2c51e1e764102366f0aff |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:436f10babd78a08e92784726d03928bec6c67211727ac385fbeb8b5be68420ea |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:1e9f1dc8597198d42d6c137a9cb283d5e40e50ca4f06cabd0e57b179241c51e7 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:fc7e3899e6165a234aa1d0ee2521d96e0eb2b0901caffaeccb26b962550f9e29 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:0480ad610c1426d7134113f1ac289a2f99b964eb3d17fa4ab6c5c87bfbced0f4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:bd1b76c80aeaacc980d16b1adbc8eae77a437c0d2f0fa608f12af71c84dbc7fe |