dhi.io/cloudnative-pg
CloudNativePG 1.30.x
1, 1-debian, 1-debian13, 1.30, 1.30-debian, 1.30-debian13, 1.30.1, 1.30.1-debian, 1.30.1-debian13
sha256:83a48ea0a6595a0c842429be25bf8921e48198c813492a8ecc07629e5a8a3b5e
Manifest digest:sha256:917cf832dea5d36e24e36bff7a66118f7a55c2398d54901a7ebbc76e75a9a155
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:12. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:d487245b1e99e9cdd3900d009506d12b49112ee356350b86350f0ef3867cc3a6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:2de789ea8569f12c53bbe85c53b9b482ecc272a9ac01ef9cc28fad8fb72265f5 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:2954e65053b4589bf44c09822a2b36c7902de5b90d27b3d7778fff3d57a55d0c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:0d119734ff660f543019f101f7efe7bd3ed912a2cbdb8a555075ed8891194c4c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:912a4867808c4b60d816dbc8ac9d23f36906c384fb843e49d394cfe81d77d2dc |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:006fd797c1da3207cc54e8e32f5ad8309039a7d71527cc748a0566a377872cd4 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:0126bb0ec4e41aa7d341046c27f2eb5e1bd2710131d2a5bf68f13d5f6f04d594 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:0d43a14093fb3f22ec7daca3c8c3ecbe7895933102dc74aa0d5292566422b3d3 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:db0dfc43bc36d45c8dc0801032c7c7f068bc33f25dce373e02740098466b599f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:e3bbbb8fa341b668e8fae4a12191dca69e42c51171cb2db16722e8f67b6957a1 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:155d82c7cfe2b0ef5d83460024d1f4e254b4f9f9f846c668b8f776179a673ef5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:1a8e00c3ff77adb391af236c7c29507e5448fb4990b892a8b5140e63c245b2fb |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:09bca7ab584386f8bb666e898ad38ebc1baf0403b33443f136e73add7cd05462 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:4c3db3c1eafd683219e74d0ace7309c6b252ccaac1aca4a4099901bee59ec934 |