dhi.io/cloudnative-pg
CloudNativePG 1.30.x
1, 1-debian, 1-debian13, 1.30, 1.30-debian, 1.30-debian13, 1.30.1, 1.30.1-debian, 1.30.1-debian13
sha256:e4d1c69825db36b2d4fdf2366f2cd62748f14efb925f198047290a4ad230d2ec
Manifest digest:sha256:8732a335b4f7fd38d04b362aad6c21b32ef76c13d91926355580fa5f76ab89ae
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:12. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:097677d23b60c858021d0b48a31de8ab8df8f2a04e2841261d3298f38fa3e7de |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:77ed1663eff4e41b4ca851cfa1860199ccc7f4924db0a5fae1047a5320ebf11c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:2a74183631571f81cb01f9123ae7efd81d32a4e7529ef7bfba08b11448660287 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:5c6d4c7d4edb26556f482c95c7c52122af06950e9c167b4485795500a83366f5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:0885c91db4a4e9faa311eb9506a4541bfa0981454ff201615c4b5b9c3ae8e0c4 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:42e838d95e5a1d2bbb5d058a71eab86cf40e45229d3dd44ae0fdf7ad09cc970f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:57e68b71cb31dfe875ac216622c6ad89127a87efdbb246a4e5a8b87d333fbefc |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:1e8653eb23f0c388541cf1cc71796516a2ed99eb30167224a645496660be3ded |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:28e6f71eef274ebb8e529ebed1dad89d5ac82f286ddcdcf5da9ef4ddd7510696 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:9ed4834d21a9b8734b8216c294c424850645484d588fab9ea2375b5a462256f6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:b89604bf10848011105460a3fb10617cf1531df16c76375b8f6083764bbef717 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:34d5f77ebc4fb4fa47ef1df2be7b165f742a0203d9e07f018099037cfe166b08 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:07362d18fccffa59ae38e7e6113f5ded50935fb28057ceba27f397575298076f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:42a4718e30c91314fb1d13427722f841ff489cd6a4cb142a7f2cf24539f3cd6b |