dhi.io/cloudnative-pg
CloudNativePG 1.30.x (dev)
1-debian-dev, 1-debian13-dev, 1-dev, 1.30-debian-dev, 1.30-debian13-dev, 1.30-dev, 1.30.1-debian-dev, 1.30.1-debian13-dev, 1.30.1-dev
sha256:b38d94cb52713317a7c29665fb3c0d4c91ee66c8dc60925dc494b08c5e558abc
Manifest digest:sha256:128aa0063aa69e5a14d37c1d5830241a9c518c3953f48c53221f18aa2fb15f37
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:8e794348f7873710ec17bb0c2d323fbd898c6d49480a526432daf8331596e2d3 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:135bc6685b2bbbf0a100395e15e5a1b18a24a37cb73771ad92af8f020e14b278 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:75d9e468a6aa51f63de3615b454bdf008ac4452f9e56a470eeffa7cbe2290776 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:c97d40bbbbe3227a86a2a705172b8ec342e6d6515db1bb03a45cb6b91f6af8f4 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:c049e89c24f0dd8c9a5c792a99c276c2ba0a62499d551aea031481941e42d539 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:ceec7395ad2f059c1e9c456f19933a535e0f570aa93d6ccde14366dc962eea82 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:819ffad1c561ffd5059abcc78b9463166b1b83b7fdf8361769b3efd37833a96a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:47c23a0163a69026e53467fa422528e51ef1e2e0836ef4e186e04db7d7982144 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:d34c646d586819b3a979662160e1c7edb6393d823a93ecd0d3f767d50f21ba46 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:1336eacbe2828934785adb58c6ef8ce840baf9ee7831c1bb16f292e9404f3b96 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:874dccb763e8d2c7e8492714060a29f0d01d8a530edbc3ceacbafe7f4ec77acc |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:272146a9e474f9f631817259168f4bd5d19754e01d11dd4f01666c19a0bcb442 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:c0d95548841cb69ef1367e8c8a9183f4f962b34f7808d6322ca43aa0901163ea |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:7458022d9219709e13051236f69786948586eaf9211f0d2a1434086ba79923fb |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:6b0959a4962f9b45197669890e8e467c28abbbea140425bf3b78e9b416351527 |