dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips)
1-debian-fips, 1-debian13-fips, 1-fips, 1.30-debian-fips, 1.30-debian13-fips, 1.30-fips, 1.30.1-debian-fips, 1.30.1-debian13-fips, 1.30.1-fips
sha256:a2eac897032521625c449ab9d06d1b80a3ed18c7af96e5dfcdb665ccf9085af0
Manifest digest:sha256:7e8b898a735b5607b7d33152045bc989c6e31ab9e25f91be4234864d4e1322f8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:08e8d97c4d397bc2945db1edb1deb6f3a2f7737266f86d4af28865579ee7242a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:f6bb519d3160f53ee79935604a312c320e1196cd6ae0d42c12c2016dfc4ea472 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:0292c455737434d3e8076958ac1df0ae6dc16534980aeeb7deacd0f6a04f7ccf |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:a009bdcbd05727419bd140f628418331cf946698a991d3ee2035d97766eda6b1 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:89dcada9cecaa9a095bf11526dc2d4e93f726cd3992c3ff10d23260d1db59437 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:4b20bdef2ecbbefcbd4430dc38412fc7a77908e612ba0bb21de45c1b6ca502d7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:5c706306e2cce0a186824e427bac5ef05c096c5715ee2a003b3dd08760a206c9 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:935d50fd2ace799554fbb41c27ccbe6832292bb1b36fa48e7991c6e7d6ed3665 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:39c89e225a1f2533072484b7bd828cb6462521eea3adfc99882db16fee757920 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:dfd09839809e038cae32c1afc74ffd8b0f6771aae92c38348480b9da3ad7e640 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:49a8718590b61226c00ae2c9459b49b1af1f22a6373bc1879a789ba40675b0ac |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:42d354c25843138833af02cfe382f76f5df16ba1c19c4ddbba69a005bec7c5d4 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:b9d0c591b597346a6a8d74e214533bc916bcd3e99a334f708447e3633d5a2d4f |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:1852f2dc0edcac0ae1f1ae0076e1039b90bca84df4dbd71138e8eb49a7186cff |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:833288bbac7d3089948c102769cbde360ab393b2f0a261433d5a5cf1337710ba |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:f28544606e2be6c4bdfa2524672832ad00f6bb2a5386cba122d510653e542388 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:cf1f02030cb9abd7daace0264cdf488d60dd1692c876e6a1d863a10950bb4236 |