dhi.io/cloudnative-pg
CloudNativePG 1.29.x
1.29, 1.29-debian, 1.29-debian13, 1.29.3, 1.29.3-debian, 1.29.3-debian13
sha256:9cb2e9a697198ba08335614959a15e542e346963b7814e1d60af4dc2cd4f0704
Manifest digest:sha256:8032ba7793790baa3024c699468ec9fa4b0721d9e37e773c63e196a2a8494b52
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.292. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:95776b971b7f15bb27c0e3af60e2254a8aa2eec7c01269bd5ef5b60eb3a4f05b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:469447619509c3dc42e217221478a6e37ef013383d2c3a104c82f1f90bf61dc4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:a2126468bf6b36f0afe0736d75b06c5a3dcd0e44a8d67c90246072814a555eef |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:5e997eb9ae4a8a56211b9d18c1a5cbb64c5b10cb4d4e555f335bcb7cf68d4203 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:b581ed5122e0fcd25e5a84a21d36fe28eefac368276c6e0b51dcee7304821e58 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:5a00d094eb9a5178171c449b312c602ddf45b045c9fdf2e077f741a2175e7ac4 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:1e6721406f67b48adc48b8e631ddf6f10a08914f6f2f364290e3ce136495fb7f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:d0f1e70c5ba8d33dcc4b6bea90670c42c6b6f5119a114613d8f82ac401789cf4 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:011441f75fc7eb3d643dfc64129918d3ff2c754bcdb94f6b76e8ceee809e79df |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:2fa69d12e0a456122a96929d900546807ff6676f4d8f932e366b56798479515c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:98423f756bc6b71d950574c2f9ed7d7ecb10bda9bb93db44eac1190d62ded198 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:d92d74a3f15786d72c0acdea033e893fec5b1e3cf81e43dc20bcde67b42e1eec |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:c6db6068d052897046621f1f253da8688b59d1f273dfea93fa6dfddec20bb5cb |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:2231148036ffe48e7cae056d5e268f07bfc3232c2bcadce90c833e2dc0ae038d |