dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips, dev)
1-debian-fips-dev, 1-debian13-fips-dev, 1-fips-dev, 1.30-debian-fips-dev, 1.30-debian13-fips-dev, 1.30-fips-dev, 1.30.1-debian-fips-dev, 1.30.1-debian13-fips-dev, 1.30.1-fips-dev
sha256:00f57b3f229d4e01d1976e02ee032ff3844b7bac7d453b172a032af7d3436cb7
Manifest digest:sha256:b38ebebd6afef1b287be19b4c594f7a0397c2b06432c8c7c1b729081cccfe4e5
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:90ba71b3ad41f935612be73ebe72e72bfd97fe9a6c2819b453e892f316516a60 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:9316e8bc641544b51a8055f993da4429956675e4e128f6ccfd2b809b889c04a6 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:fc722a858d71277a35d5bb692ce889084758c32cf5d5848ca0060ee3615d2b00 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:b92437b21e54963a0fc46b91234e0d4fa15f8fcd71f8dc3786a58b00b88ac1ff |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:067fc3d36d48c29be2516190ccfe696d294a59922bd7b240db36b4395d36d106 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:b9e1ba9213b005e80c7e66bbc2e04b62edb4ad3e5d9fdafe232444b8a52dc9e6 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:526a2bd16fde7a04623b656b22cbe3a90a0e00eb1a17f20fd2351f3d2dfc9828 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:9fe90a365d7d2ae426802d911e215149139a01affb881318bec9050d23318ad9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:98f033444e65eaea933f708bb927f80786667f4267fcb15a0ac448ffce981c4d |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:f347900a7fce5e2b9338ce41512ce62b851d716f502fc3e0250e5f45f67bdaea |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:a5182d0d7b6e1b8f9ca806e59007676c65a3c102b0ab18dea16b645bfd2e114a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:17bb599848d54b93ece0cc68954b7b7a5e9e0145fd53f9435c0cf090fb88ab7b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:36ade5ede82a00a2df3059c92dec5199542c4e79c772f3718897920d9e81395b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:a95e589891d35f93720513f3383c7cf54fec98572ca12dae4075f772183e11ae |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:375dbb63b2b1fc960377f9ccc2bb9f9f9864ef01e34e792559adede1574057b8 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:8354ec8455cdd7746514de609f1e80bca238a31b1aa9470b4b5b840c2c31b710 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:ada1609c2e058e821216687cde60ed8085588b93033852255c3dfdf1c919731d |