dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips)
1.27-debian-fips, 1.27-debian13-fips, 1.27-fips, 1.27.4-debian-fips, 1.27.4-debian13-fips, 1.27.4-fips
sha256:e7fe5da32d8c2f7fc281acf0496d080d18a93246e4f7005130a9546306c47986
Manifest digest:sha256:6c92e2d4ca934566c973a0a4ae7505ab66ffcf17ace8876c438d9e8f9fcc80dd
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:70460be9441fb0a63ee631c27427e74bdc45e462fa9949759b237e62312b4c24 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:8f6394d041141a4b2d8cf12149e62f9b3b1f667d5085b7fa3ce8f6264cd8c1b8 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:f756d852343a7e3c8c143a2b700514fbbfb7179efdcf5359937b057b1723d743 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:a50eb9a24ff04ed107d3acf7f6c4cfe2a594e9066e73c92a6bf58071074e3ee7 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:5462c7405f19b5748012ea8fe71783897607cb21685cb6ba707570c024a8a1da |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:8527c871a8bf1cc66707a0584a8f6422cd98b5be41155ef9618c304c1594a54c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:a70a0732ad4b9f859b2018ab35e70270f02fc187c94da371ad5f7476a548ad8f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:ecb98d7cf085322ea92a233815a9021f0388b05f4bfde3a9c293e4f378f39b78 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:80519733032c772d8d54679189b013d9fbaf49eadcdc3bab22d412006bea39da |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:17a22fd34deb380ecd148f5ddea72200d16e3950db2a310cf9fe9007feab6024 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:18c3c37d02248de47e31505de00965120491e8d2549af8508e6bc5031308ac79 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:cd5b0a2fbbd1f6436e2ce25a75cbdd682a4caaba43ed2c37342fdfbb3899c02b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:0fc5c7866892ba3bb139a3c44917679f836b7bcc0a6e0c747a68584779e2d137 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:694f99109be23c96696e3b0161ed69c86470f7ad0866924ed273fed2de782092 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:97a56988f1fdc49418ef76e1cd4ab8c1833235294707d80afa6ca87b6647fdbd |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:2305e38e1437d474e59329202e57a697051267638ec85815b48b6b296b570a19 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:0bd3a60015058283555f7b77b1f1b6fb8d5c8eb03c62a298393b4702b5de78cb |