dhi.io/cloudnative-pg
CloudNativePG 1.29.x
1.29, 1.29-debian, 1.29-debian13, 1.29.3, 1.29.3-debian, 1.29.3-debian13
sha256:66d811db7f30825b4305d0b6a0744c8f82871f5056cac635a10d29de9f4551fd
Manifest digest:sha256:513edcdfda107ebc82337852c07830d2846a6d3f9309655582882fe4fc0bce1a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.292. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:82338540867df7e22303dea94e9f6b564e1f5f8389f04f4e688299fcf077f4d8 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:1bffc8aed25b945f7aa717d6cfaefa9e55f40456415886b11eacc5cc86af8312 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:ed9bb339c77f4d6cf2a3e108bb3a36c3b1fba2e8cf244e1e82803cd6cea92ed5 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:187e0b5a8a858da332b3821eaf62dad4fa82788bb21a9b5eb75ed45863c1f424 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:314267230dda7ce20f490d69b16d568e7e7f3430e29da3e978caf3a115b33394 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:4e1a475c946bd9837c77b1df94a6c7288040c9bab9dcab14227d0b0583804d4a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:a5da266c5c2d2befaa72ce8f85b55438e5e17bffe1c2e224f54fb039fcc76a3c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:268e0a4c34fc162e35d51e4c00f7274dd1640e062c46ef00e80a628f6a1c03ab |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:bc8e540ed5669f62d9ccab8071bf54434aab025ec3e6d394abd190ca6aef47cd |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:f6787a7aeed87d6c4a9be8935b5eb821395e4b4d176fe3917bea8fd152b9949d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:916f14958697f559d19eb9926976b31689d66cdcfdfb05804cf1a1dcd55cb39f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:41fdf5e97a896c265dc5022a2bec8171de70f1e9cae99b20eb6564830337460d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:8f64aef6808b842c6f8add18175f4925936deb36e589ef507cac115c6016eff0 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:23a6e6241b2784413afbbca3a0a10170b6281c6baca00f5f8209d281074a046d |