dhi.io/cloudnative-pg
CloudNativePG 1.30.x (dev)
1-debian-dev, 1-debian13-dev, 1-dev, 1.30-debian-dev, 1.30-debian13-dev, 1.30-dev, 1.30.1-debian-dev, 1.30.1-debian13-dev, 1.30.1-dev
sha256:60c0ce380dfd80c0fa2842fb930373cb36389076bedef41de7c17d9d9422baa4
Manifest digest:sha256:4ac2a58cbcf339eff5bc5b46dd4b0d27a6403c5e5fb6e013f914b312d133fb4a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:b5f49da29df6fd12d5558b7bb9af44c87fbe5feb81440ba938714c68db53cd72 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:abf158cb1e3a5c88eb19cb317355f1555990b8bf5cb6b7f4f1d6cdf3709e7b3e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:6004629cd5d5eb1fb58701f9b2ae995de01c5dbc65fc28f55de6401a2147c28c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:f7222667f97274eebabbbab69733790c3ac1980f216a3a8b787b2697f6b34857 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:ca2484203a56b6ca46c87bdf004004e21f37d58d8a3a2f6497ef230449f54870 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:9da452721045127040c36f7b81de31b177a2d243f5950937d734b5ab8e386d5a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:87b23ac0e30498c8889ad2703ca4bfc9c9cb75beb2c900e4ceaca2d306e7b0db |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:6ecb5787ff5e6a285e16c85a4afb74cdb6970192b9f3100cd211be84720da962 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:a365dd052da60498c03cc53997d8d2b36f450ae27fbbbfeed99291297c1def2f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:6726b767ba76bafedd09bba64ea099bea3dd67a12fa07fdf2ff965a3b4b3f9c0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:b0783636fc1667d5ef10401477e7b8770d2d89574673a7bf3bbe2af187f62236 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:eef82a8a35c54b9afaaf6e64547c8a9919b58ba0058b61502cb6ba1beb02bd3c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:e4109c2334f867f96e812223d499d17b6b8e199b1c529326b06f67f5f5ba8831 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:9e4b3193cf6c009f5d39ba83649a54d2d3501b6789e913be815fee9d02f41cbc |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:863d4ad4d5a9619fdfa5637ece1907228856bc977d6ed6296673352603f9aa43 |