dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:a4467f9f333300cf6da602554065461c667277af63de313a2408442bbf75d4e0
Manifest digest:sha256:3e6f02ec4ed40944a529d1d971a5fe896b634ef3230fc737f7aaa3eddfaa6d6d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:a8d39420ac0ac35d8614bff58909c6d6c1df561a9416424084a96626639fa348 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:19c68e21f85a1508703daab8a3fe23ab84e1bf0276c6d12a85daf60fb055b417 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:a298c7edcd04e08168c7c4fe420fd92a3cfb659036fc4a9c135936fa37dea536 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:7602bc2140b5f07aa854cdb6511296b51aa9cdee2b3ec1e73453a28a7bb9b564 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:095e2d94ae717e4ba4629cc2dd5dab437576fca8d1ab8a9a3e35b0bd536aa484 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:2d3335c9c0b44a8fa5a6973a2ff01cb7c71acaaa61240eedf1e9fa1bf8daf43f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:dbdfb1a82d07bbd38c9583e01ce829f9961494e3f65cd0a4818112089a669cbf |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:8be0d2289491250f16d02d766ca54e6a0b431fbe888494420630ca9473917c28 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:431b5c51d5dcb29e1aa7d888d0902e2fc1c6f8894815708c5ca9ff1881120b67 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:35f4f240dabaae6589450a7aab1efef2b62e0999e73249446600fae929199de5 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:84aa5ff51e15cdf24e41e30feff8db6851871a3a554c1aebabb2dfbfc657e011 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:fc98cdeed9712c8dca2047bb781ebebdae77fba4112ce677af008bb44847aa52 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:02343471d69dfbaea92f294a1569b5fa15cf0d88a0b67371f2b1e5ece773ad19 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:4257849b08319e22b38d0ae94fed79d36b1bca7e61fd587db9bafd47a035d450 |