dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips)
1-debian-fips, 1-debian13-fips, 1-fips, 1.30-debian-fips, 1.30-debian13-fips, 1.30-fips, 1.30.1-debian-fips, 1.30.1-debian13-fips, 1.30.1-fips
sha256:9be0e13ae70ad328bb27040ecdf9f0e420346a324030c2eb11f7c9219ed06e4a
Manifest digest:sha256:8e6dcb8c67e066ef3a247668b604444a5c937d14068fa138760617f9153f17dd
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:68399ed83e26f5c4949b69d6550e737cec8a8562116df9c7d64869a1c43313de |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:18591e1ec7e0ca03f02bb8313974bb7d2cab25583240506d5df7045d17a69395 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:3d96d76dacbb5e63e896035db4822e106f93a96e7e1cb7626db4decad731e4fe |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:ca57c8322d9e3d0cde306bb05d44984b749618b3f8a63976f7b3a314e409cc45 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:9726a4a5fcf4289d76c9d1b6a1410b5f2adf6fdeb3014b49804e9133f5248569 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:078d82a044f581fbd5a4bf64953c8bfe0aa9c9b1ccb30e003886f41f66f9a825 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:d58ff5632280352c59a6f145501b6fff662472f7ee2fceefc75d2d9b8ef959d2 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:f27323572aad6ea8261cbc4df50acf55f334c733df2f159666d12787aaa37aa3 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:f621ec105afa325470daa88c44cdda6f442fe39ecf0bd69d37f1ffce89f0ab5f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:abe643f6b2478965d19104db2bb402fa8b793bf398929fe3e20a6688eb42acc4 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:a8712c96169ce54e73026b4d9725090446cd202efe3dc138119423a9b3bf51ef |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:c564e034ff632b51106219a2903f00f24f43b1aae292cc4386ba475eb4be78f0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:33106e12e3005c29bdcddbe874721c712f5f65923f2b01414ba77dbd4dc190d6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:e26a0e1a84c9cbf2bd8700f734ea78e452983fe59ff8b505ca429244f148fed3 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:49b12de27eab048cfc66c577c6b71c9559289ab6614e6271c00db8532c2c0f61 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:5a04c086982b6cdba332ad2946a0edab0f6456a97d26d1b2e7a7986489d9d29b |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:2a5ed60a6d2703601d26281fe31d38ef19d78738dc6111273f42fa045c7a6fe7 |