dhi.io/cloudnative-pg
CloudNativePG 1.27.x
1.27, 1.27-debian, 1.27-debian13, 1.27.4, 1.27.4-debian, 1.27.4-debian13
sha256:44d447ca11671434c3d2229c87dd2b41d297b203be9327c37ea8cc234b8904af
Manifest digest:sha256:f33c64b7be14ee58e34c3882fffeb72fb6e2b1ab14b593d221350c5acd9057c9
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.272. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:d5f5f1c22605a2790bdf31a696fe85c74363ceee12f265a15b2997953ddd902d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:4db1e0e723e255fe827d37daf3b76f1381748e2c76b9ddd0b635e5a60b72abe2 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:93facaa17f03835431f88c772efcab2eb48610dce957c44945a232cf92ec2750 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:9c6e0cc69edddb3f3a96cd1db83ccdb6ec6ab0ed59146200945fcc9dea48ef59 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:591a32e26cebabb48557867e2e3b4431b8dc9af963112eefd6cea67d83d3dfcc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:88435a996151486d136611a0f59e8ee40d8972c3d947d6ed7c39b824b32b341d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:7cf449447e23f050d6d0b7e91357e268239081e3ddaea62c05803217f52e35b0 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:047ffd59d973985274f9310aa055851c200a86e1a780f4c0974ac4adc9c99eda |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:b73384307645eacd7a63e47a6a2b8f932039277c0040c7da10138e56ef9c0096 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:6445532e622a1f66ef4ddfb22e0f20f8f4c931bcc1b196d963ea27fc4ae78806 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:77b8045a8e05c48983c2f92852f82c59e8cfe1d9198faaaa7438db2e091798b6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:b14bf9cac7d8ad5659a23409cf9adef04a7f7f0d1d19d65f348ce1aef57f8654 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:bdd8a75067dcab5aba25747f1492a52ad74bc4ee2d25c438d1b8341e6fa123ff |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:7cb157e1ec662ab1ac8ed872b2e29832fad3431ffc50e773764689f4da348709 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:1117fa791701729db3ef29b94982d337fc22b5d0853db07c256a6a560167cb1f |