dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips, dev)
1.27-debian-fips-dev, 1.27-debian13-fips-dev, 1.27-fips-dev, 1.27.4-debian-fips-dev, 1.27.4-debian13-fips-dev, 1.27.4-fips-dev
sha256:82dc38e515575e9010d0d4f85fa89db0c8cebd1973d45adebe9b1652d1c1454e
Manifest digest:sha256:6bc60c047d13c2b59c2fc00551f63704c530ca9f0fb069f6b00ae7aae12915f8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:65da03f3c240f35da93a3717bc8be7238ff66880dec5541eda23e1b6d06e85e4 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:b3557b5bfa93ece9bc3e88b70eb934b16f8afe8bb3f53048425050ddee0b954c |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:f53bfe324907e350bd7e07d312863a0f8d3960baa21829c0a29e7f801eddb6c1 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:e264eba5974c6e8c001e62852cc574c1c8922dde3a35a55c03cf8f3713232997 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:a23bf5b3a8c0967119702d26c5fccb3c0d2d0a3a2a87748b72a90f7681c77b17 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:1c351cd82bdd2c2c7b1a625b44e2298d83a6032f67703184337bbd5c6e5ce464 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:9fc2d8b3480fb55b204fd7c5afc4715f73a155f4ae3864f0351267d8ec450fd1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:7434c7acdd1523e624702d673bb89eca7d08e07d5245a0d134d5443bb128d734 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:1c35de5623929020a155f70db018647acfb3c5315f8cd7960c1859cd9109d66d |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:8eb03f116b4514c4ade8f7741c7a049bd0cf16bf2e10989615d12e457128c5ec |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:26416fbe5d0c3b19eda1f2d3730b63e8f7b76320942acd95875853c8eaad32f3 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:29a89e526c6f56f54e6778f00647ebb8527451b404d9c264b23a972745cf79ef |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:a87b7b1408ca5cea68768999d83fce6f44cb6743c5c3bc766d574fcc0cd07bbd |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:9ceab3305a30eb65b4c11fcfaa36c8138bc965f46e668f039a52e589c6fd4b03 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:d0e6eca867594683f610e4dd1ab2afe927489aef91889c6b1a88944b4368de02 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:5d66ba5a6faada725e0870b734bbb694aeb12f6da23e15652ee09e5fe95aa1e7 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:fee031beb3f74332df709036c33d801e7e06b484e239a2e2be0898483deea864 |