dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:09b85c93850563c06e4e7f3155e0885bac0b860520025fbce3bcd7efc9f519d3
Manifest digest:sha256:db836623059f89fca7f72448093b52d34bf0f99220d4f981cf4d04442baf8df7
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:f14d07725b7ac6a8b9b53453cf00b02a5ea832519f0992bce21cd3486bce6b09 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:7417d59e16753984727c377aa70501d43ea2ee0ab4a7d5fcad4765a34f17f458 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:b6ce2027c2a18aea827a4b4521ecf990ea5cb17af29476ae8fbd67ac976a14d4 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:9b25b0d4abea571f58955197ba7aae00b208659534868f50e9c82f2b0b0a954c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:bc54478921f01b4b973c326f713a4baf02815ad5955d5e137497ec10b207df15 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:b8cc4ef8234960146d44307b5e2a8bfc7fe43c4239606885b8d7fe288ea5fe92 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:8c57013cd6c35e274ab7d88fef43d0224ec32115e81d49228054c07ed5689020 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:2682492a7f78fc5a9e3947dbbaac16aa33a921abe09ae29ad0609491b9b28877 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:6684f7d562de1b6fc25330ccb0d21a291965900f64ba942aa26c3f8dc1312928 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:289b764eeb43a145bd1b93fb58cc3eb4647c32024931dfdeb4a33522fe137c40 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:f593024d69d28db6f4b2ea271a95ce1a231a8de859186a15f4583f82b02c30cc |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:2695cac5d617670b73832f91129f9422b22250f26c6ad47606ba5c5aea8fa62a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:774674152a5424112e3c242183ce76c29be4546a4d2d2e63c8b00d83461ff310 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:dbf660ada1e952499a947bd3ca20564a4da5437e65a9ef6526047e509a6feb77 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:d4776ada7d3f5c0c9a6a7427a2a0fd0124dee996fcd19706e5f3a7ac902b6560 |