dhi.io/cloudnative-pg
CloudNativePG 1.29.x (fips, dev)
1.29-debian-fips-dev, 1.29-debian13-fips-dev, 1.29-fips-dev, 1.29.3-debian-fips-dev, 1.29.3-debian13-fips-dev, 1.29.3-fips-dev
sha256:434eda7de28666b71f587986fcc256debb20469c77f3d4d46cb1bb80df2254ee
Manifest digest:sha256:bf410eb76778af60ca6ff26e580fa188fdcd3c8283fbb69ddbe4bdc3d58352a6
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:a28ad376cae8d77ba3c5fc05b90930455951d3039dc2d8b2b1df66f821a81141 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:bce45ab5762db5105802c9caf6ab50e09f51068272f66ffdc1b3fb8ad819d23f |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:4c655d19b8fbafd22eb1e7fad2fb86edb6abb8778b66c89a25c38184fbb0173b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:97cf9b3f06f6548ed4429dabd9b2f231c6b1081f6d07c30176f9b7f5971287e2 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:c12d29e34c1e579236dbcbd97d53b2fc2fa6d30e63b8949b09cd5cfd231d6130 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:8602f9a0952abe7c95884933b56717cf1f2635a1040efc983bfbdc852e9ec033 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:664e92f4859576a4c62181b84916f28ed93a6ec598938b675078802d13e61535 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:dcd7dcb11c61fb91741ccc05ee7eda369466815e6f76251f9d99224aa2d0dd40 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:77065a66e536ae4cc452c9d074a39b045a49c584bf2a95dc56c9aa8afe8fb908 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:0dd656a18a6ae216be2853675ee04ccfd877530a260b56e8193869b72efa75b0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:86e62294d46eac4fab71f96a14cce34a4d1310f2a27f454246ad26eadba3488e |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:d7efa7754defbd627dc86657c581adb8a829dbca77a33c0d3374953667342c3f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:deedfe2990e4a845e696d65bfa489bd8947e55be50d6c6dd54ed212f435a9f42 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:09f8c38d3362840e6a1f34948be25a0c78f053d2c5ad576cdeb87d4d49ac1c67 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:6bd8bb09045cc0d26e75d3864f737527f4fba7f722d6e63223bc3fe7cb49ccd8 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:0769b35d4e557a1082762972a02684f9d06b6356b40241804af95b6e9cb3a359 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:20ec0fba212467c2cf042169e5d2732790e3d5cec147566591145181e42488d7 |