dhi.io/cloudnative-pg
CloudNativePG 1.30.x
1, 1-debian, 1-debian13, 1.30, 1.30-debian, 1.30-debian13, 1.30.1, 1.30.1-debian, 1.30.1-debian13
sha256:3667185ae6aaab446b6c4853ffdf330318b4f72e1b18cca3db5f22119146db61
Manifest digest:sha256:8d82f461e8ae62d61d1863896c80f7c7dc42d4d8da3af0fe0c437b63b464963e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:12. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:f69fceca6ab3239d4bd048b2bf1edd403a2625d5278562baadfaaeface9887d1 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:777b464153e528080b7f4765306725a482329afa549780099fab2906adda446a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:5fdf5d193649a56480e63879b3f84441031d95fd52b75c7c2b61f82e58ac630d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:e8ce2f5654cede69c6becca01148cdf50b792362f630277d8d20ac898da7b6d3 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:4159d276801d86178af4bd85c4610799fb586b9cb6cf1e0cd022af01deb4df79 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:11dec8f3cfbfa5e04c56b820c5e0924bf137f5ffd5b5415c8ecf432c027f2ebb |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:49b642017e0dfdbc1ac549307c1cec906b3c19e6bd3646e6c18c29fb75fba52f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:16ae0b1672e72eb0d8d9b9c6566f4ac0078f1b4b2228712d920662446748d30c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:3cb79b721aca951da0dd1dbf1841d87d2858fbdf7e90c71c4aee13f740fbf9df |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:db833f5db6bae4aa7fc55eb32d65714e89f3bd2888f6833d745d0a7a50173853 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:7fefb117328547204e85bc5603e19265c8125eef7d268a4207a416a848970fed |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:c1065c8abef0561e65a371dd4421f3b909be577b852122ef5fa3a8896f468082 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:46c2858ac754d7bd229cd6f21be6dc4889a277f24c86f718aef35d92a90de27e |