dhi.io/cloudnative-pg
CloudNativePG 1.28.x (fips, dev)
1.28-debian-fips-dev, 1.28-debian13-fips-dev, 1.28-fips-dev, 1.28.4-debian-fips-dev, 1.28.4-debian13-fips-dev, 1.28.4-fips-dev
sha256:9b97a49a9c9dff57e39c3a31bb6d04c0c7de01034177a5041470f7b63730f8d7
Manifest digest:sha256:266f117a828315c5b837eeac30f44adb1e25a7c0fd422fbdb314fe88be079b0e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:8e7c3029620c3f8439ed9075b106c824b09a23bc92e7528e51bd361c5bb2f60e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:f0d8113c1b3748ca9a2fd0134587bf1263eeb339e0805225866f2db383963fe0 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:f5bfdd350df789fbdb0e703af6109dbd956395c4747f7b72a8764f57410b382d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:e6ff67e551ed10d1360a859cfab583bb5f3be738cf8434244f1bcc0cc07dd393 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:e44c05791855682d7ca7bd6511cb168e39ba9aff809d284ae05e9609ca8036b3 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:b1008bae85de61dffc3255dd6c2f687c1c03393fd58c0815ecfe9c7a7247b735 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:0c6dc1d5f8786fa2780be9239121e85d1c206b4b99858c1b8049e602982c7fe5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:2fa2917a63d050ecbdee896c7e1c6e8bafdb65fff13d31cee8545cde5422cb5b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:4f2b527fff282286db0b28921e94ef9ecd96bb929b4451992e0d9c0cf588722f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:dedceac203d35354266deca74eb33462a58fb9c772cc46a75268688879711fac |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:75648fe6a7c55b886869a49f17738f1440ce928ff57a109af1f2cc8321cc4a22 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:2ef5de656ebfe856aa0e5709a0b84588daba11db586bbeba1f47444daea6732e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:8c506349edcba5c090b047c14b24d883b0b29b01e4612080b9a8247b1879d617 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:0be6933a1e6c346ae93388e4956535b14d4b884c9dac27290d8ef976dc44d911 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:7c96e8806797105215cb4d9550ab4f9ddd5439ac7efafdcf59054d7962baf827 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:fe13c90acd93080c03ae88f6964d788d716028307cdb485de8237877b8788653 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:f8a179e060cc6adc933885d38a19b4877a76625c8a28bc254b837458f7962ee8 |