dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips, dev)
1-debian-fips-dev, 1-debian13-fips-dev, 1-fips-dev, 1.30-debian-fips-dev, 1.30-debian13-fips-dev, 1.30-fips-dev, 1.30.1-debian-fips-dev, 1.30.1-debian13-fips-dev, 1.30.1-fips-dev
sha256:d2fdabd7221ef2fd7d1fa905a8143a66019580555828fcf4b5bade9f61675712
Manifest digest:sha256:685247231c4a17a94f464a41e070beb1d1e178c4c92af4f960147efd8c2944fd
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:2fe968c0752f020ab042036f7f239bf0f95d6c03948944746ac353e6694909f2 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:12efbb79e46b756b3618aea01bfaa7b1cf7a7ad41534479163d39ed374160fff |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:0f60d9d3ff73333454ddcf6b8874e615b534fdacd26a91c7058f95cf0d194dbc |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:2521fdb1779052e151f674e5bd57a49d1378de9a2014a871a39f702c738f1b1a |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:5d1184461f22fbe6072ed0ea0ba1ec8430c39c571c00fe44d25700f00eecff32 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:2a04352478f34aef7c201161d813511215add7e0fb59c398ba8f443626717d3c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:3be86828799293a1e6e7dc870015f24dc837a37bcc5bcadd7daeaeaaff3d138f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:7e76cdc445e3ba6de2244230af978aad5454fa012571fc8184cceaaf1b25b463 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:fb0cf4b786faedb0ad551a02d0d6fa5023bef6bfcbe92f85c2d7fdb4bb7288f9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:d94f7babf6413f18148889dd7052c660b89cf55eeff02d4948bf2b707fd7eee0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:46efa1bc31043ce133a6917713b55309bf395f7393fc09f1fd3d09ea17af07a7 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:d37ba085977aef79516f8b7afd90569e34eadd698b9709e0dcaee3da951e0387 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:9d2e7cd2f22072e1a79399b7279e763db2bebda88041a5eb34b8138affc3e995 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:b0d620b7e785480f99fccb0c65513e129dcb019c9e8a8df55e80fa79a5463ce3 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:49dfc41e35ec13398a82514ff6c18b39dabe391e3f17d5287310b22f4df4efbc |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:db6cd88ca1f04782b3795958f8b66de8e4fda1b3f96db7a5f23df3c6a16aeefe |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:03127b2a069ead336922ffc5c56cfc555e2a15d43ea7de217d11b0d62b1918d7 |