dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips)
1.27-debian-fips, 1.27-debian13-fips, 1.27-fips, 1.27.4-debian-fips, 1.27.4-debian13-fips, 1.27.4-fips
sha256:a78ec037ad21eb64a665447a2275e588aaba3792cbd2638a1c7e13e59e83e18a
Manifest digest:sha256:06749906d006916f1e0cbb3837346773f9a0c00525e23b0539c5a21df427cdc8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:3fa17a90b5086d09be90622cd60285da6012ebc81e2c280d41da128b5488d4a4 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:355c499e0dd68f647855cb1ef1823f4a09eea4d7cb45f64c3a680ce3862d98ab |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:63bc69f7c58701177ab45096dc873fa2c6d5087cd69941ac3a9c0f1f0b3e004a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:7a270a2084095ef8fbf81ac122e485ac8209ca9191435961db5c4634ff42a468 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:0d848fe43b26e1a6934349b6af47660281cf5ae7ecadd962c5d5942a4e629665 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:9b2e73c8ef93b88ba2fcb789c325dc3c360e4893e29dcdffa8960274ef1d2618 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:02a4e85b1c909f2c95c36c3ff286b59d66fc95dfc888f491ea87517881e49139 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:eb75a66621bc44411ef5ad4ebee4149e803f81049f8ea1527a6b54140f6d24e2 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:bfdb09206beeecf2bbcd1d567c23d9b81113820df673cf5f1559ef3381da777c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:fbff0caedaadc402189c270607c6369dc18950d26adee412b545a258cb82771d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:83d4205c372e3a56acfa3d99dd2cca3847a359f1c570c1695019c10f7e98042b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:c9131b0807af632d1d7350fc3862529d0fadb7b73f7d2890cdc80d0bee1afc39 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:144568ae18dda959a3f721907ffe7b7c090dc2ccdef4090ecce5795b2d1670b0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:28bf8b8eb76a8c7aff0a094c407b8219762eb751acff6edfffdd724ff50fc183 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:a20ef11c30ba424c14129517cd465b130a4618bb7c7ac976cefada6cec03c898 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:53beccc01ae5757c00e12108d9767aee69b2941116bbf83c297aeddf8af5dabd |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:41fed2d7eccef387050ed5d974086db8f711244262226b07f33ad01ee6192ef0 |