dhi.io/cloudnative-pg
CloudNativePG 1.28.x
1.28, 1.28-debian, 1.28-debian13, 1.28.4, 1.28.4-debian, 1.28.4-debian13
sha256:adf0b80d5361b189dfef28fb51cb0e9e6dd834a1dffae9a3a4e6a2f97b559d9a
Manifest digest:sha256:f72dd726484d0ccee03a808897110b6da669077d8ba22ee02fe173345da01c60
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.282. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:c0f98ace300d966b1ae341469d07810797291e9e6a84917420b10ead2f43b21d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:94e1171eb520e6d6e60e96577cc5e9e402aa300102b7850fc372fa4bdb0c8fa9 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:0624a245b398bafa5904dc337f185c1c524713e0f6d91bd95a16fb9204bd4d1a |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:1987b796cfefbd7fd90999e88f079f1af2140735ca12f33b39debdda0d1e8b69 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:c48f08f23b0ab2d52292562f7f1b6ba850a7a3f06f0ba536e39cc492be76a7e9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:6e3b3ae90914c8d9b2db8932b9572bf838d1d54e8f216a06652ad6c2ee9be20e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:8eadf6d4cfd8eeb7467427130fbecbd0a477d8a690535a0cb1c9491c9aa4642a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:6053f8ab63f6be821e94d44207124caf57a73911e863e0656955df7f886e62d5 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:fbb5be7fd940c3e8f8466be83021da7c8cd94dbb41bd6d894e6aba13fe735940 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:8aabaf8014dffa4d9be96799c170a50ec2e00b550406a0e1ba1f1e60d566665b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:ba8542f1181e1cb5917c4829693a0b88fbabddf55c0f777343df85ab15e1a52d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:26927e37eacd71615b4f4fa35537422a28b02fa323a28f315f8ba9ad41a499fa |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:7d9d8d25c74074da67253af08b7f43cf436b146d125a70df8c203821b0a5d139 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:abc70d9739cb9df8ed4b4f866d6a1049aac96920e4d0c219d2d4707af900ed5d |