dhi.io/cloudnative-pg
CloudNativePG 1.29.x (fips)
1.29-debian-fips, 1.29-debian13-fips, 1.29-fips, 1.29.3-debian-fips, 1.29.3-debian13-fips, 1.29.3-fips
sha256:c10666e5edc3f34f30a7fb310bb18b204d24258be5b21366bb564576c40bb5ef
Manifest digest:sha256:1fff96dbb5d02507d5804fda724443a9296d92cf6c4503c6c216bec72042717e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:7c776ea2ef15c72282eb0277514b51201a8080baf86889343174288497ba02bc |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:72dbb97a67a969f8b3ba6a72341ea7dbc7d31e60ddabea1cc9991b9de98b7e8c |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:a1d8d12c0714577f424391d85d30cbf73db595eb03e22bd114467ed90c4aa1a0 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:e471ede1841babde997cce951313ad8c4adaf0830d07f2ec154d5b98ec89d350 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:9166eabd31a3debc8bd4eeb741a80a5a0fe97009231d5e9e91896ea1fba53427 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:4fefd3252c086e1b5635fe875d0c50c436851cd896f31c37a10b4e15a5d8aea0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:48cf3dab505ed8b1aba02b18c4be8e3ad6830344f141004bd1b07ba2633c92cf |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:ff5c912d71341fc35f880d24467fe6664bc86a137e80f7b183abc5f4e45b6ac7 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:1a47a1d72dd4f575aa7aa720c19e20a7d615b592d5d0c4ef8952d94e084716ba |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:b6d35ebbe419fe81d1fe533e0d5010037a5bd08994df437cf630ff7da591b1fe |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:ec8bca123a95272ebde0b4645dc8e440260a80a65e47282b58f65e5257710bcf |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:64614a4b61e5d0cabfaa2dd85a2d5492ead7f7159e840656c7729a681271f050 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:6a57610c81acd95b60b42809280d07181e92304870c3d0d23fa20bd0b4f744f7 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:3fb20862eae0955bbf4e356a16dba7ff7822f6a77454a3fcd594a801f095be4d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:0229312c0710d6c8b3f0942e48b9fa33a14f3749038ba8f76311feb747ab07bd |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:8e1584acb63a552678b2e2cc831a3a57549d27ce3aa0f8923eace3c245c15586 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:d809bcd16d25a09f6226bd71baae5b0fde56830e38bda855141f712209b7d2e6 |