dhi.io/cloudnative-pg
CloudNativePG 1.27.x (dev)
1.27-debian-dev, 1.27-debian13-dev, 1.27-dev, 1.27.4-debian-dev, 1.27.4-debian13-dev, 1.27.4-dev
sha256:be3551d0c2ee54d161fa1bc422e7a019c88a14df8218ba31b905f11a7e222d3b
Manifest digest:sha256:b26120101f70aef5638b6a4cbddfd08f026a438c4f0eaffce8cc4ac8049912ab
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:c37fe82f80ea283a318482a5ba6849eeca33b85199a3cf6c55891fa88b43a284 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:3ec3b0dfde1d7b355d409aebe683451b7a3bd9dd0e858a902d151012636ea664 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:0ab8548ba6831008474b7cba1d9e63ac09b148344dbff7dcfafb502ba68cefdf |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:5767af8e2e3ba47df6bc4270ea9d1c803c80f5250d84b996cf5f8048a5441366 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:262dacc3fbc402cc63096d45edeec76d374161f4ee7262fa75d9006955f75085 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:195b1a73c3381067fd93f1280c33e9efdb5d86f84dcd5a385300916d62df5c7a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:a9f0eadaf151d9de7ee72c96c73b4ecf8121b35a7102527cf59f2fd18a301dc9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:2fee1f7fc17aa8f20f8a1c5936396fa7d093903a6b4483dbe2665b9958fc125d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:d126e3919a50d9df312d0e8087882122cede326d7557887540521a2bbce1eec9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:d6181ca3ac4bb9c5978289303bf72a6fed2938286a93acce8439e04d926fc29e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:3d674328451d2ababe08ed8289120057bbe49b3fd20b238aef834cf3bd91b487 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:e7df13b1a3288a4265e583213eda5c624683f53eb01ac173438b18becc400b88 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:b4cb0069a6aefef443fd6776abe4f5c0fa9d3f22781b53bb03b7593839de5958 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:12e291997d40bf6c02f17e5f7709509660b7f2d306e521ad46bd54508f8b62d0 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:78a50810ab101481894f764c4be3cbaa514d1c724622b39c30dd9cb54cd1daf0 |