dhi.io/cloudnative-pg
CloudNativePG 1.29.x (fips, dev)
1.29-debian-fips-dev, 1.29-debian13-fips-dev, 1.29-fips-dev, 1.29.3-debian-fips-dev, 1.29.3-debian13-fips-dev, 1.29.3-fips-dev
sha256:12c9fc79c99ab9b30c0234f99744446ec46d40e0cfc33ec54d6ac7b9ad0245bc
Manifest digest:sha256:35888bc8ddc413bc07cff8703dc78de0740557786b15e5983667b2d326e6c7b5
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:6ed0345f39af1b967295cf06b449159c9db5bab72faa3241b8dc00e40877d604 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:cd3704242a5c517f6bbe40a6d49d5fbe011ffc2f938dc5b1e0aabe0a36e46974 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:ea4850792b2660995e48535f5ea0a1ddbc4fdd4c738ccd8d4c06f89c3b906564 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:14670bffc75bda6ea8b02abe49128fa288877b1bd582209e06782c512579683e |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:6ae90e497a7d912c4b307cd86928cbbbfdc89b1c7ae91de355fb472e53305ae9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:ccca73e69b50a87bc26f7376ac6b0e79297da20f73dfb050cc00b2a6defae29c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:f20e39411660dc573dab12a06e42cb143717cd31b4135cd777c117b2b597ccff |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:694a92ca416ae54c71d68992f7cc614f78b7327f59192ff29e4c2aa2bcb78ef6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:2e63a98e66a28a44319e2eaf8c044582d194052112943b7f322552d94d5b2d1b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:c5c60c1fccf2073cc648eb2914e8600f99af4881d7a77e7ce0307ef72ee635eb |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:7f0cb6aac1c1cb8897b7c7abde35e6fb3f2f2be367ab92636743d97d36b969df |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:7e620c8d35379dc68b7dcf44f1f8ee15806bbe09a694aa66cf53a8f4a4fb2c38 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:0dc1aa7f5ae34908d905ac2917643c9575c841bef4bb2b2430a89f73c86ac608 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:230413d65d284bb94835dea0e4a2eea7ab0156a5b11e3ab950a2f33a95e5d115 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:4523b9624e8083669e7be314a423df2432642917bd04be369502b701a087df6c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:b58c02641ab9a4e107c8d1540bad5b961aebbe68b874a525dc9ac26c46d8db77 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:a008e1d19c7bfa4abd08a6472f54c41d5057986d3dc192957a1b87da5e5780e8 |