dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:1291376e81bed89999c0340f530c67622b48754b1c99cc8ee99e79addf15070f
Manifest digest:sha256:e6ac8c0e138e2413ab9aea53cd482c5e930b8ae37433b255c0ff50c68a0928cd
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:82d8209734434fcd7faa9fb68cfd99548287fabe3d2cae1729af83c66e3f1ec0 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:8308a916a769230c4a7cc654446102f5a093b722b7e7f3bf6358089f510d319a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:1e49a07f74375c201e873560d2694d6b44368ff9c082c746264bf4088aa3de0f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:8afa3cb2a4dc2386f1a4ad40ec5943721c0a1073ba15d0de02c535ed62a9913b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:1cb857505c9acf7ec730cf423dd08133fdff9a263c9618e5caaa0b40640c36fc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:b4b69087bf632e90e31942eba7e3fee8607b18da874b9769d44a5dd5bd1a5448 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:9343f4f8f21fb69b092adac5219d0283bf486006aa07d1d208dd1b47d21e3761 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:9c791dd2ca07700f57d4888d194b7a4f809204f3e06d4d45b190e5bcd1610548 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:ef475ce86f9bf4b96bd62e6539828a1697ce8ef27dd10a6320a1b86ffb67c4e9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:5d169ca3079f0053f824ecba02df01f9540f1fe5514fbd78238624987b65ce43 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:41711dd9dbdc8f7ffd7fd36672a219860ab8301666742add8b22b2476207bc54 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:3fe1f0d3576ce7dc61af519f66490a20f1afb5515b7428dc23b7614107415c7c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:f9e3e45e83e06b7d48fb7a8212fe3f1d69588f156392749efc3cce42f40c4e4a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:210cdd1b844f490c21822cc265a16014e6bb531498b3fa4254e654ba72401359 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:43f758c63a8c0cf0562b9f8d141e35c3d477125478314d14c4caa087b115191d |