dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips)
1-debian-fips, 1-debian13-fips, 1-fips, 1.30-debian-fips, 1.30-debian13-fips, 1.30-fips, 1.30.1-debian-fips, 1.30.1-debian13-fips, 1.30.1-fips
sha256:a6e95bd97bd850b306800956df50f50ecb585902be3c5bdf4a2f5253c3a41fd9
Manifest digest:sha256:43ba26c400e5e7cb8dff659f50fa45df7e153b361d4a429c1d99673259aafcbb
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:d779b170f0db4f7d8e2a4c31044f5fead0b79071e9742adbadefc6496b6aae9f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:f6b86e2a37d234a725c0de088c4aa6734635be77b71f07c9fc7961c82b1ad29b |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:8f5400e94ef1e5e04d99f0f7faebc15df54e86eec4cb6dae25e25750c7a22054 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:d1feae0feeaf5ece6011a9573dcf4ad0f4b46b58d21c49dddb9a110f2cc6467e |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:407b5a88160bbfd76d6f3e989ca3589955a9db3c93ab3083cc578d5e114885a3 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:b23a581333061911ec1a3257f3b3e6582220210fba0e32fd89d581f3a928807f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:db866e76548bd67310767571f13e456caa7e6515be53dc953d66fd118262b16a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:910c5dfecdfae79a35b8777adb6c71db8deea142350b4c329f37ca9f53fcdfa6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:7e9a489224607e0a2b4943e365c40eb657ab68ba0ca0a1e9a12c5f69363d3c21 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:d99f2c62fba74539a77b33fed421c64a0271ea2ed79f43e37bff478a6add8c8c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:263173640e9d17ec442bd2725db44da0939a73705c4b9957b10baab3fb63c134 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:3bf64bac84b0e4e12ec43b09c4f4985e61079d253c202a80e6bb5187712b071b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:a0cc2176dfe6d8949177f5f701023b46089a504277855385ae825d9ef2220a23 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:766df3873d32d743a29f476df133c372bfcacfa42cc2bccca1c7eab5038e9604 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:1f673cede6940234bc28645a294ce6064eeb8487767f1fd0a63c0e95b49e4fb0 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:5274664b51f3ef5f921597bee7a9d67e5fe2e208b072ac3d8226e69c25b553d7 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:c08c4b76fb5b8889354fa5436248485973a8a2745085f4da07c02b2b3346df12 |