dhi.io/cloudnative-pg
CloudNativePG 1.27.x (dev)
1.27-debian-dev, 1.27-debian13-dev, 1.27-dev, 1.27.4-debian-dev, 1.27.4-debian13-dev, 1.27.4-dev
sha256:3778c0e6288da765a031a22e3efbf6093fde255d0445722782230ea2f846ce1c
Manifest digest:sha256:e66de67dc4721a3e5227555c5da310b24db72e7cc0476e30a116ff0d14e68177
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:6bc79267ac15e89ec01b1630882fbaf9b603066190779131e85d3b3b5987c032 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:44da3d986924e78dffdfd7d9a64a483b7e1295904b7c1d8ac312e3ffa5fde367 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:bf656a0634726e1ed492dd05d0d857bada25981a546d91c4d0c4511c1bd2644b |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:924e03b33b6bf7d6b61f150445b32f2bc04e22428df92e371093896cf1f82ad5 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:28913d9864e2f40b3349028c0aebbdfe55fe935621ad00cbb1b02c125291c5ec |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:6e3d1c4356db1c0876f69c55650e141dfb3ed3e7d1117f646ea02322d8825655 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:1f97619d1c8e5d3df701a2306e0177eec48f44abc912ddf16a827c6fa3646fbe |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:dc99737abc22c1462b5d8dd7c9504274a837421d7da5cdabf4e5af6079f3be3d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:0e737ad3b30eebaa04ddc085906d5494537b56f53979769d79a2029758590eea |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:8d3118558691c5371fbc3b3d727fd5130b0113c1a22e8e920cf83bca84abe59f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:cf985a0aee73518f19e1eb035f349b155561e8c3a357ab3e5c6587f8d83441a4 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:2c49ad06b4cb269125b7cdae40da2a816f35b32674ab6274f4023a91e1708897 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:f678b2906b355c50798ca2a1df120e8adbb487786325985711485182497e5b0e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:01aada841851afbb510669b258057d0c5768bff24a51b26937a50209a9cbb65c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:a755d906643d22951ee45f1ca6cfcac80e0fbbb9a516a8f397b3de28ff1639ff |