dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips)
1.27-debian-fips, 1.27-debian13-fips, 1.27-fips, 1.27.4-debian-fips, 1.27.4-debian13-fips, 1.27.4-fips
sha256:f263a97c0261c77bbe506b080632d600608f861765495db95f87be029990831d
Manifest digest:sha256:7af4c2bd7f6274d41a87bfd7b1468a5c4d93b607ce2fe8247d0d93babc2f1569
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:821f797102bf3a612b5e983945e2ac15dc85829ff59b433afb8bb8b7e81a36d8 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:7d4a30fd0e5bbfe922f1b49591415b7235841c03d04b3c6f5d9fa133123e393d |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:43e178cd228184c238ac758833b9de956dcfde29289da0eea168af9a0e6dc665 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:0f20412d48ca65d76da9499c6718187da73f48ce0e8371145dd27f882bd2d61c |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:d17ebb3f0562c7e4fdc663265828430f1ab541ae8a52579e2090001bef4187b3 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:cf76d2a5387a4c472a2d8391244e085687922b5e0bfd133e54d6067e830e2d7e |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:c36df5d6d6f47a59b37c5471ecf458df2914470bb4d3ff3c93f08b9c7bade4c8 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:787779da39e52aa70dabd829d5c2d53743f71a039cc61ce5d950d940873d7f64 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:ca784c382fac1ff19eeb3f31858b417eaebefbcf4857abcd34baf179108d993c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:a3d9434df2cf4b3b73ef9fc73d1b9e271c261774266f7e77545133b56e638487 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:a63bd5699041be073dea933113ab6282c0e3dc97fa27c75f0751341a2276e8e4 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:f049b5ce642b55e503f55f41086cc56462703b4c6204113ebe99a2a1844f03b3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:74004404f4d2b00c13caedfc4bc21dfaf0073c98eb9a3ed1dff698861ef8541a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:1c4da8b92896a9d052e947e626e1997580747ceaeb468155bdca678f612a6627 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:c289f42041715e7a29160d6b60d9c0231fdd09fd22628259e3ab414992e52828 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:326cfbbc06384f60b530961e4ac9765d98d442775465e3c70773f2078562ea5c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:31dd6d0c6d29bc4924a4c04625cf69661b67fd204d10f4e4be9e68dd4952703c |