dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips, dev)
1-debian-fips-dev, 1-debian13-fips-dev, 1-fips-dev, 1.30-debian-fips-dev, 1.30-debian13-fips-dev, 1.30-fips-dev, 1.30.1-debian-fips-dev, 1.30.1-debian13-fips-dev, 1.30.1-fips-dev
sha256:abeacf82318534d8ecc267675bc142d6f6ba37987ce2c0d9e3875260d8388e2f
Manifest digest:sha256:44cab1877d8654caa497cb5960ec989b07a187b630bbd46ebeae0873d4ea4e39
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:21c22d6a8a056cff171245d2981fc5901a201b1167541424efe66aaf49478d1c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:71fe66b4385567a0102a9d9b0e31e1aac41002517e2e8f3622421e4bfc2ee986 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:2828fd353aa37923a5397deeb625bfcd94b01b94986524ee4df21ef4eba63b8a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:9e9160ea415ec8c1cda19e774b4a6cdc45d531dda522c08f2442e62f3cf749ad |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:44677cd0e12c126f362071b7d6d003e7c9e1afe96bfb6edefd9de4cfc0e9bc58 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:e64ddcd387c19ed33a22aa48d85e58766c5d217b45614f7e063b528a10dd80eb |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:843bc925c9042263c8bbbafb935eac2f1f7848f9d014805ebc07ea7f0f38b2a0 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:96b53e124fb3fe2fffed2c393fe954373201dbf532840a5867068743e93942d5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:531b0f3ab26e869e539eb6ab4e36a84e9ee6a0cc9485bbbcf07533c764139047 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:5457e946eb2f1ce833878193ddfc0eca6247af655eb73030689e8c927764c164 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:de4094e86662f03e3befc3a3289ffc1a3cb7b9a0cbbf532864c0f553857126cf |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:2971a4ca5d4f00b828fdc94a80f3f8bf09317b49594c19ef9cd01d8515ae37b0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:20b67e6be7582e774890db4a90b1e480dc503dd53f588e6fb1464ff15cff64d7 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:4285243916b5f46f11fc466093fb5dd840f109d5fe2220717c0717ccab5f3fcf |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:b4863070e1c7985031cabe1d2a045ce6a9af7eb1e757cd0193b335c23ce1c186 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:3eefe05606c49ef3bef13afac87a86904768bb5197829bd66c74d8a211bbeb37 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:df11a9aacbf3fc799ffb4274a15226ff4a7a4ccf9362faa145db85b78832d9e2 |