dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:f19bc413341c178983adf93c402282c51db47bf143a9fe8a7b0f418f422ba004
Manifest digest:sha256:7afe6cca7a04ba01f772762b36a95cf9becf57bbb0ba686deb95dff3d13186fc
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:b82a897cf8c60ddf520ef2beb0409fe9742a75eccf30b8bd3d928c12a72ce9d8 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:c0ee553ffac7d1cbefe964a237760fcfdf5cbfcbeaeb297c016906ecf76957ec |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:8eef4947cd0a00c55a042445002d2107007798c05898efbd8ccad0aac3ca9997 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:08a02fb91bcc18bbfdb2a65890e574ba728f4153e01327559884a7283336e485 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:08d3f0cf7424cf79f94fdeaf30360ec9d8af445fa980d7fb1b72e7d45e0362eb |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:926e93d1b5f8c4054b8eb8c556d0e32e416f554790c7b6a3691154b2197abca6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:4ac3ae321b1cacd0e36c0d62fbce00699273c696ec611e3be1edabba605b3121 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:cf6eb190f1084cc8d9ce6dbfd293d47dec0195e665b383b4b974fe2c6eeb338f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:596d760953c66d3372d238da28382ebb0f21bea48ff2a17ecd874e19377facae |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:f030f07debad10433a525fd71e35a107c58ced17bf818b55ffb5c5cf1877fcd1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:b26be0d636cd6fe585cde3bcb705dff0c8df0346a33e37338eae2eb660ea18d0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:8502a1bfb88235bb3e6dd3374d407a2b8c482a826259e9ea342bd59e3e28226e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:1049f2e635409da421d0366b48b511f03a7ef96f87c89a0038a8ae2b34b00b82 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:e88fed74e9f9057208ef1884d4b33309ae296f81258fc4a25c725156755c0fe6 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:0b06dee68eb915216d63568abde277152d81bfb4584f0c7a94b82182cc08e989 |