dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips, dev)
1-debian-fips-dev, 1-debian13-fips-dev, 1-fips-dev, 1.30-debian-fips-dev, 1.30-debian13-fips-dev, 1.30-fips-dev, 1.30.1-debian-fips-dev, 1.30.1-debian13-fips-dev, 1.30.1-fips-dev
sha256:71a4b643006b5726b2c3ba8fd029f45921346c07eb920b059c426e0bfaf7cb4d
Manifest digest:sha256:d7dae2fc5f7b1e6ff6b52eb284e52b80a331a8f2ac4045b86760da279889ed61
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:fa207a0318a664b0170a6f76f9a46f9fb0974a23b63a18404a76d9bd28ef63f7 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:1c07934a94aa1983832984eb2038b492d8a9b9b3f51b71143d495a1c7261558e |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:292557491bbad6e4e354827ce6ef0cbf22cfc70e31c479c3152284bbaace3aa0 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:72a6738c956d59cd94e463933caffc6ab58deb1b214dd7a89a73843bee695b14 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:38baa3173bb67a17e4a25da315983326b38cc8247a8cf2587ab304dadb5a1394 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:80d656398e138d037b9d1697a18adc44bea059ac6f61a8c6ab1edb619eb49e40 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:00447e0057b47555b96ff13d87663c9b25c159a250f664acb34822d44f7fa808 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:d5948a35ed422489ed99edeb2d4d240322b64ed706143c749078d77cc523b9f4 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:056ac8b93a76bd90750b85284f8716c58400f2b1a55117c97e9cda9116c7b987 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:aaa2f03971e98ae978017c880eeabcdd3fda70ed290ef94c586ae2ca19d6e9ca |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:3ee1aaa1e56921189ad8e6af6f3349f44d6596e6f4843130f621f4e48dc9d379 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:4a0c663fce90975c705c24b8494ab1b4fe0babd660d3fbe578b2ce8536422e69 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:7bdf9df4b61578a87f785d0fa7262ef96c2b66c900ba1674ef36ab6d5928f6de |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:862f3f30be822316e4ec14a7cd86d9c4a42f1a0b32dc04b1b8c2aabd28ff9da0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:16bf85422d14acf9d1ea31565d4848ccfab7372bff2f7af61789d378b612c47a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:d5faa7cb858d38011cf37dd6a30511585b4a839171c72601e96f7357698f297c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:c7a387b047ae9e22a0c99af4fba7c576398db3ea88b2c899ebe93e78055d6207 |