dhi.io/cloudnative-pg
CloudNativePG 1.29.x (fips)
1.29-debian-fips, 1.29-debian13-fips, 1.29-fips, 1.29.3-debian-fips, 1.29.3-debian13-fips, 1.29.3-fips
sha256:2be1364aa42d1d12178cefb2ca10dfc03262fddf14322a73e4a9796f0d40cd00
Manifest digest:sha256:91d34dd77fa488e46af1785ab287adfb7e41d1bc5161dd7f477ad52680ac3165
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:1ccbf9e43dfb83a336a7c9648c6a65c21337148ef66a784f9fec1fc78231a57c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:1f3d256b015d2a0e2c4847399815505795a9d2a8ca3cf8fada315fbd37b7e8b4 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:2c23ff8a61b993c3d485b375d9edf7ff0b12aa42520d394ad31ddd38811f97e6 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:9657035049d5dcc95c97bf5485c31122983a89d28b48015c25a41a4b20e5d8f1 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:9a49c89eba2d1cc3da652088c4e2971f31c8bcbbe1afed98c98dc49a6fe07bbd |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:03b7f416de3f70e70eb785b81cecbc2e9c27489446e40dc3d7b7d50a43a54f92 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:c8b30496533fcdd44244118fdcd9d84476c2bbbbe0644df37b97f76618ac0a9d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:25b11130680014988191d32a6d3a4f727b23e40d2a1b906e034da62fddee4e3f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:d795510a6b806a161420761392c4c5125f8a713298405f9db93c322cbece790d |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:0d627aee22e0d915c256794845adf633ff13ca6250e3a71b05db501525664afe |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:f602d028e3a01a51f0e223d3160390d5207e127721a4d5c0713ab903352bd853 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:15c6ca4bb9de989849e3a08f08e52599699501905eef9d1fe68aaca494d1c79b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:f1ef121ace1e3d0074f35cc54271e65f6a67fcc9668fac6b70e6e0d139c86d57 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:2fcff67077b4625079b41cebc870d43bd3261cc616d4d949c814113905aaffd2 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:60c14d3b0ae17a9971918145c8c5ae702f130be74d0972e5dad8563433e9dcab |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:9b0e1c34914eaa76e80c5cbbd981055ae676f5df249b647dfcf3aa628517b14d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:ff9f014fdfe9e829f0264446c69d4b529190d4a5d92fd6733802188aac5291e1 |