dhi.io/cloudnative-pg
CloudNativePG 1.30.x
1, 1-debian, 1-debian13, 1.30, 1.30-debian, 1.30-debian13, 1.30.1, 1.30.1-debian, 1.30.1-debian13
sha256:e351aacf3a3e59337f6df21df752cc19d1dcd17765abeabd1fc3c4395a886cf0
Manifest digest:sha256:367a55fedfef0887101f81a86ecc38e467cf8bce37692c1e1f0e301d5d476e42
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:12. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:51bc70cc1667b11a3df3caa0ba4fce215f26632bd296ba8edec68199357f6462 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:cef5942c5cdc364b0b3de2b66b1175960be6bfd21c97cfc476412fd180520cb4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:d2407123d5334c1bcf50563f05bcc6249663be2baafd8fed0c79b4b8e824069a |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:dd67be77db6f552f53ea68a603a78a590575983c5e275212451e911b166fb0ad |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:9451d76029f4d33a83a22388e24342086c936806284d6cdfacc6cac614323ae1 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:64bf99e9754405d8868a50973dc0ea6efed8d1f0e852cb831e8325f97fe508e5 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:cc6da8e14ae405785777850ac5b1a802f40ff04658f088971db508c91ae2b7c3 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:2c697956fdebeece15d4da21426bfb329c8cad8a3f6b8c4c28637a5e0c29ed78 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:2034ef6091620e5fce78211532c361735016fdcc7f6cf0157f100d031d6379a3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:a7a0533849234937a5843d5c158136bccea16453dcc2192f3276994de0cde308 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:55ec2d880ca181f607a046bfc86098f1579c8fb5d00978e112fd77a4cc19c632 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:6069a9e79259e9afa33d75320f0478ccbd38b53d5b9a7549d9b4369db99fb9af |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:8b16ad06f530967ab856c81439a936d8c4012adf18bc15b3b59a51207d9cca39 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:ea0660d3bab5faec5fda5c7451c6a61562bd00c27b9a8b8f01219f74485e480b |