dhi.io/cloudnative-pg
CloudNativePG 1.28.x (dev)
1.28-debian-dev, 1.28-debian13-dev, 1.28-dev, 1.28.4-debian-dev, 1.28.4-debian13-dev, 1.28.4-dev
sha256:31b07152b710c3acfc0eb5d2841ff69ab2458d09ef20e6183138dd946bce7cf1
Manifest digest:sha256:47c23ea1d0e63aead8c12903448d6e76846aae9f2aec5a0605ee4b6ca5a4f869
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:eab3ec0ec2e973121f528b1586276022ebb870a6656e2713450d815ef764617a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:da4cf22cf7dd2c9b1c94c6ecdedab6999c63d627b7d01db9ad309f93d893e0f3 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:4b2d072db2d95b974f4cb16910c90ad882fcbd571ad06593ed00c79b4ae4e0dd |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:26df3993c4653aacaf6164d9d946ba0a809362fb5d22018961c8aa1d2ed44136 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:e9c905e2521953d6dc748b149cc877b8a241e50eec37ba6e6f0f3f8934935eaf |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:5743a3bee8c38bad316d2be7704f24f35486224a3b83e4ba279aa739bd864b14 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:d13ac2cc719eae0e52a97336afea015cfcc4cbf61eaabc1d7ad83e31201a2882 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:66a2deb1eecc464730f2188cf2ace2c62d7f7332b81a356e0a04a606c53ab58c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:c17056bd73f47efb7e4c40c7e904615afb7ab860c9db23c94e5cb967cbc01e14 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:ac0e96a330ee0d449bcdd25fdef91ff103b55a286d840d1a58b52f512ae5d890 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:4758053db3d2699b3948f6cf7db4e7fbbaf384b7b74219202ecd06783e8bf708 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:08a77e4bd76aecf8bd6b7beba3546dc0b751c0a393b9d9eb1a69c32f7a292085 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:10eaa18f59aef296f855476f360e044e6fe965b43afb9721edf1d100b13e1ad9 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:012ffd42cba597bdce530e33a4a1fc4b164e60526043a8e79dcfe1cd9055d3e9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:c82aa23375e8ba4c156ad06c5dad903b97a112eeb32edebce75c99db715e1b92 |