dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:66c3ade49979f81449af1345c900b6145821faf114e815c7d985c3ed883facd3
Manifest digest:sha256:7f1af73493f7d9205d8c42c414af96537c7990e7eb53758eecb25bb2aa4c8578
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:513e0ac4b99ec799a029b41b8637389f48a2e5094853b1b70071982380c17997 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:1c09ab4da7dd82570c0083bd31266bde992419af99b6c2e436927898b48138b9 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:62b5a3514110413ea9db9584e5cb55f6ea6be27a047fbf824262a2b9a10ed482 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:b3ba8725248e5289fc375d110ce712fa5027a0d203eb3a46bd6a079aff8c4981 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:e56740366194f5a922e95593e2e61010774107f42a57c0c2928f977b795696c5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:f00809f799a169f39940bf21585530616b69cf1583a5aa34eed26f72da17cb48 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:4c83367ec298ec2bea9772fe1cf2dc618409b2029b4e18627a7a87040ae0bfbe |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:3e082037bd5ccf39c8ea083f89801a671d0c72d983f8934112e973e60c42ad3a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:383664785219d4f603a58b9d5dc0fe91fc3cb20fb45baccef8e35eea61e5a50d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:a38b8d9aa2d28f85493c26e0bf91ed29c3d5fdb89d27b41d7bbba5e6d531715e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:ea8ea821a261d8b5b70870631b19841f6dad31050b7e2a3aaf89f23319c008d1 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:2b48450faabed072357b9bafa46953b689167ac1a99221489ec18d2a9b2f1bfa |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:63fe54e8aedde2935b67f6e5d1cfa28824fb6042fe65e5bc9134e32d8bf89e06 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:d4d3ec70f0c426050e0f7de711c127aa968dfa08927f4bc6f4a149f6711ba1bc |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:c2bf5cbfca5337ffc0d46914510f7ab1dafc8c29d0bacb85ae7d18109c65fcb6 |