dhi.io/cloudnative-pg
CloudNativePG 1.28.x (fips)
1.28-debian-fips, 1.28-debian13-fips, 1.28-fips, 1.28.4-debian-fips, 1.28.4-debian13-fips, 1.28.4-fips
sha256:7a0624f334251516edbfe57d80cdca5b0b655ededb37792579650bae40cd526e
Manifest digest:sha256:c97b8ecc8537dde14fdbf673a3bfbf4f000390b8eccead093c7de1f2f7aa2d61
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:8fac1792d18c66c39c987295b79549cd8e1b75fd66be0d12d51488c21f18edc8 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:2776484c6ab28d35da0790ffd2dafd77135e9c7499aa796f7e2bdfc0183de55c |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:a000eb5b364d3ff126d9a7ed3bff7214ff24e0f984be1a6342f0257426b96b56 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:fab13cd240d64aa941242f4033650b6674c458b3132182f6fb99a87b5ae20c21 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:9c73b1b2e107e804ce5e6abcee690cf12b7b4a444cd9067fd857e950dd295a75 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:536eb415b8cb11097d1a2f8f5ed1e020ca62a778ba6d6a71125a19b27416239a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:b377d8648bb7bad9b3d83dd543c56eca2d88231308a97d5692abff8d24f25f19 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:aee5edd643799c2f7aa501ead6e287d3260c28843369ee747868c1fddf7ef903 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:fe728674010ca90250696aea9e971d52a110ef0ef412d8b803b53d84ffc6a2b5 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:dc50319db273a843ac93ea24ba9c5121d5aa734c3953551d4c50d4a199b805ed |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:b3802c59e4ba5f8c02dc062c633e1e96b557d9d587db460831eb01ae28392ddf |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:97af4a5fd1e9b11f9215dbb3537f24cdcf493f798edcf9e88c91ea3328a12cb2 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:e3331e4d1407b37b31e4bcc91a59128132b4cab90efbcde8be584fa89979f11d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:9bab32d4702ebab9ed2be87b0a112a5b19ef18e1c9950b6021fb6f1c4a27e826 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:2c9c670ae8502e9625e300ae71a50ccfa0bdf56e3079f1549b4330847949873c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:338c31d3174200c77e0b7211653cae7ba41cc5d6136144c5836b03e9951dac97 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:250dbae169d2d9dfcb0dcd0196c1212383fd957ef17f4ad2a867ce910d9a2cd7 |