dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips, dev)
1.27-debian-fips-dev, 1.27-debian13-fips-dev, 1.27-fips-dev, 1.27.4-debian-fips-dev, 1.27.4-debian13-fips-dev, 1.27.4-fips-dev
sha256:c92f07c10d5f4f452b2b0cae3c13f1182e096b4860181cbb0157238f5b2e96de
Manifest digest:sha256:9c2bf073342ca6047ab056156004f5f2d83141ee74e167a89b18739fbd8aa81c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:8a4ab297975aaa676bc38a11ecb08f6de443df8bb32a9947397aef0d0e525b74 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:d9a1442bebcce30bc537ee14d11c392c3f86af70cf86fcdf20dd1fd2eecaca92 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:4ee4940e99eb17eabcfee04c338bcb14d59ad1a7142835a2a57f5149c2fd9b8c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:bcfe4b34fd9f2598bea122ffbfbaa63e31341b65d50d4bce822db6d92b78bd2c |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:7b1edb8902d5938608deb48338d2bd6d0bcb4a20fe5ec43218ea2200a49f1b5f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:1bdf7cff5c19af7bad4693b6d9d7f6259d384bac630ac89f3c0ee2862fe4f589 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:bec2aaf38c16a978197ddbefcaff4c5f977f96ab48ef91ec0a318143e692a57f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:a8411333e0f5562ab6802a77392aa53e29182c932af9e5701c8e96c5d02260b0 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:1000baa5f9fd8beba2dd5df97eeeb9cc6ec008d1f76dfe1d5e59699f99e45b50 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:57f5d30f33e881e9e8f98ec7b6497ea9fbe027306c422b5912485e8bcf071271 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:7cfb1062ee3e103a14c4a04e1017544f2fc9daf23179cbc7426221629d8cf1ea |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:ad4318735cbcd7a6bac72a22a9b21430f34afbf0401e67c60f101e6dfeba5114 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:64f1bd7264b846c0e7f4df88f70f1631abfc0cfd2ea2c8b9119bb31e93d369d2 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:949836c5eb2eddb46e11ba0e087d437cd49989771e40c6cee13bdec8a3f37cf5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:30dcafe961e751a2bec5434dfe0bc7c5142b18267a7ad0fac716c2951be56462 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:271f48bfea30bcc2ea34430bca8f0020498ef8e2dcbcfabe6d4fedef14438261 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:59276d658ea08a717005f075a60eac2a14c6fde1c27851444261421253b3f3bd |