dhi.io/cloudnative-pg
CloudNativePG 1.28.x
1.28, 1.28-debian, 1.28-debian13, 1.28.4, 1.28.4-debian, 1.28.4-debian13
sha256:ea35069cd8a6db6f9c5a8a696a6cbd4954b320fd55f16e400a7e2f0ae8c90b26
Manifest digest:sha256:d2b6b432f8a1652f1cc64b7a822aff0f279d6e2c43d4066f05c53c0d100f6a84
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.282. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:2cf2912839741fda9a0b6e0b2dd0cc52a7275a6b32bd88021f3ae2bdb97cdc6e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:8289d23dd144244dbe7f7df357ab5d197d272f2d805017c9f57998aa5bea5b89 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:15f5216728ce13b976bad1ea7cde1b0a43d4b9bbff4263b29fb87e9e764c1e75 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:775e56745a73c5f83e6b7c142ef521548c383aa28413b23c0f02e14d6c4bc426 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:1c699979e30395f292f181843c0a8bf6ceaddc2705d72c32ea04fadd2108aeb8 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:4d92be58a6f551cd02c12ab7dbee2c2c15d3c53c03dbce882de0478e6658c806 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:be2bf27838cddb23a176d0728375ad6d0a23ed0a280ea1f97ea7fd8ecdb2fb5e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:fcfbd4bfff7fab3327e6924a87b210bc821c3853d2a7190aa99b6e6b94025f34 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:982de3954d1b2b37280f389e25dca91fed4742945220c48387ac2d88474fc4c0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:084ee13c5a0fb93d84a58456e6ec31ac033ad14bb93f7a03ef971461ce605be7 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:bd2fad748b2d0ced10b7dfd803398d8b8066e2c2178765cd901dc96ac0d043a7 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:9c8c8a93a9f68699b6adeb524e92f8328282718f62e7d03d46564fe9e5ef956c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:2425cb7075e6fee6c8d36ef6f77967a84cab91da6a9b45f7ca5ed7639cb94e8d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:981e9ed7d1703c472cc9db169c4229582cec4167144b57c4250f9ebaa12ef1b1 |