dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:101a224da964b038f131677b815f746ced5a24deaca0a228a49d004ae18b5550
Manifest digest:sha256:04504f003c4a78f587e64b715ace6b36fe32d839d448b4281df0310520b62ff7
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:3479959c6d80fa1a7255dd7e48f6a56343793ea2561da087d8a4e2be094f03f3 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:9997d64832e8e05c5bd11e0b213ddbd3ab91dcfbeee8dfb318c8ecd39ad80602 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:6292c01d800e194ac398658ab0ba5c92891ed9ed0787506fc143ba4135507ac5 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:475c15d4dcc7b287d2bb0a53c50f56625e917d8e922074d1dada44a96f8e5ba6 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:e4b7d13452fdf492c5d38f8c74fd285750018eecc100079988f11c873206d376 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:c60b8e5136dc75b39b15ff6e7bfe6fd4b38b30f9c882971ccc0eb22092045d59 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:b5b063c4e16bda3ad712b6eddfc2d8f955df6f7dec0e5bb60fa6d02edbba4a0c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:592e2ec664f5b4cd2c8441d234cb452c3bc28042380028e6550c98dd9d04883d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:0b882908d4bbc0cc6d4efa208b4f321bc2ae17304562a44acb061ef880868cca |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:037276f1a7b8530ce1288afbe2c4b8bb9d6f905191ab769fcfc5ffcf01b34404 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:32f50e8b913de470e8e7041aae69c7a7e5c926f2b2fb3118111ab58581f16746 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:2cb6f983c7235233e87b86ec14605d1ae4c9c0740da80341a76ffd1e4eba18b5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:0b653967ba62943be81835576f166403d44bb8cf8b2c5f60043d0b734b7b1995 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:a7efe9b64a60203a0c744a67e76b8fad1016c63465596c00346f865f0872c37e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:a94fca090bff6cf2df2c065b4b5d3d4e09838f994d7f6507f9fbf5876923c91c |