dhi.io/cloudnative-pg
CloudNativePG 1.29.x (fips, dev)
1.29-debian-fips-dev, 1.29-debian13-fips-dev, 1.29-fips-dev, 1.29.3-debian-fips-dev, 1.29.3-debian13-fips-dev, 1.29.3-fips-dev
sha256:3c8da990f4042a183582fd8b861256abec21e82a2d3f439c733f93dd3aaed848
Manifest digest:sha256:7d95706dafb445ff1e7bf3bbedcb197bb3dc20dfeaeb10357618df11628fd46f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:abd86f2dcf55c50d36ca0b4d1d8c2622a667d266129030cc0592477db05f49ca |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:ca8cdec4a94bb0c00e439c8e3397509e9ba96a64fdd978d3d00a2294a782fe0a |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:7ae88420a2e835ae937cec5df50ab827bfc106627c3c8501d12476e5892b14b4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:9d1ef1b8dd778ee548d35e710e36c93f2ca6654647b01f02ed59f77c75cb6f7f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:2fab2d053b12285290e611325f66cbe2a84c683c5d88104607b0229b3f86d7fa |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:e8db7e34e0a01c824f43ec446c4bcd765bfa5c7954a70e94e2258d44ed944433 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:bcc793feb784e0a32bf03dd18b51fe187da85c4087a461e4908b49e057ed7871 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:94a03a03b39e332dcbecbe4885d7b146f2ede65561db37a61e3fd48fc9f95073 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:1c46bc0977179bedcbec64a28fc0ef1f2e3d00a49a47f6ab0bcd4cf5beaa526f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:d6427144209d9d72035e44e464da6ce106cd9772001294b5ef13586808bc9fa3 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:6e388d2fe1b7442bf9f4f061e16c10a34988ec10a9a9e63aa9c3ac3aee072b9e |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:b631bca79fc5bca3fbbf4f96bb4d55bff82d5ec70ed0f3d9b7218a327ad9c7ca |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:4439d00c86850694316b757a7fa959dc92ad2c1f20a153149367e9c11cf9b80a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:bab20c0a738490ad0acf4d489f3ee30dcb7a5d50ae28ebc8430b9a12a456f79a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:b167df44773e3c4f3625dbbfa59656966f0540943c563a84b86cc5c8f602f431 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:1e56601f86bb9644894b0f93bde4df1afc3d9336fd6f3018be30123ffe3e461e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:fdc957a3fde995c41bdd726dd2420318df72dfe23fa7927e8399adce0cc75e8b |