dhi.io/cloudnative-pg
CloudNativePG 1.27.x (dev)
1.27-debian-dev, 1.27-debian13-dev, 1.27-dev, 1.27.4-debian-dev, 1.27.4-debian13-dev, 1.27.4-dev
sha256:cd6b008ef1d530fd7b2d96ce616f9c00187b57b8685e89a470e49cebbf12e3bb
Manifest digest:sha256:ede7f5a438c3a4b37e8daf968b6a4eaa49ebbc4bc717c6a974be4e9b835636c3
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:648fa2ddb770cae058b5f1c81cc61b8b39584447aafe9bf1d4cb036c02668097 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:2c39a169533f2fdc45ef882dcb8372b665b13a5d267859910a61e416caca82bc |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:068486d35425dd3772036cb436735390555d2f6e150bbcbadde28f56fa4a60cc |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:80c1da56b9c756d365f4c063cd2b463be2ca2ee5a16e9240156c0e247278c862 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:aceff2c8fe9d71ffdb25898254755a8f9e42f171e313ae0ac1d177b294a86a92 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:0ffd33ee7c8d8319113093ffb25fb76c659f3266c3e6d1d15cfbea0e74eeba46 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:6cb8eecb9df794cd15fc9c0d1ea6358f04c78a364651a2a2c541878707cf22c7 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:f3f734897870ab736500fa2a810bcc1e2300e153504c2fba902a1228276b92a9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:636f4dfe02fda3a6af2beb2c98521af684527ddd551f9ee2cdc1429a7d0a2357 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:840758a610c07168e8ff1c4cb4527cc16ec18620bae97a307358bf3597d68609 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:8d488fc9c96706221993ebd98be498653112acafc0d50ae328739871de521cbc |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:d311c24fb0101dc7eccb63e85b43e204aa0765f10aa78869f84b15164f5a4cd8 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:b8d6488241e9dc6c54925a1b1380e27948e7d869e311a70ea86fb83b331a0c84 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:8654f59ba8763cbf161887640db1d9d47978f6ecb4407b3da84199ddd86e2d85 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:c50723bb992d1b5560320d9bad1fcd0d806bc6f519d7503173167716aa766d87 |