dhi.io/cloudnative-pg
CloudNativePG 1.28.x (fips, dev)
1.28-debian-fips-dev, 1.28-debian13-fips-dev, 1.28-fips-dev, 1.28.4-debian-fips-dev, 1.28.4-debian13-fips-dev, 1.28.4-fips-dev
sha256:75c98c4344857bcd90a8eb68f5c78d3b41e5da12f7a2870195d1edaa34a6dab9
Manifest digest:sha256:c6c72711c039bc99dfe17febe7e1efc363fc4a8c6184e720b181a82106139089
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:011ff1f5eb46498d8788bf827d7c77064f305502226276ef00a5abc20c011aec |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:eb131642ff374c39d3364e24ef85d7f526494958ff1a7a028a57900d548e178c |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:c0b452c8e605dd9d2f33a2e2eeeb205ecb03aec23030fdde1b15f3a5e517d0ab |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:7da5f30f7316ee052975d22d813701d05cf99786e535eeb169395458cc44289d |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:03297624b4fa9b343ed9bdf3d22f91887be667811a5910b72678125459488d87 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:54eea9911904c14bf03c4ef3ee1673e06a8187aa414544355ada84bffecb393f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:a1f4fa58b89ace213e462f75e5c2dfcddd6b8a90c989a8e6255ba43da077258a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:65bb9db9965675bdd4c223b9863adb684fa621fa7c770a96c3a26ba9614fb5fd |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:3c7b7c1700f5b76876ef1d16927992681e50f2df5222fc605e4300cec8086ef4 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:efe60f895a10f25bc399936c291ce2e7d292439f7146a9241ef8ece98e674701 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:8c26f679c655140399d615e544fd53be6028bce1ab26bc4e39c93b8cb96da470 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:c55bda41bb699f84ca41754a24bef41f4af917a455791ba14151615ef13e324f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:b08cca6111789fb478531fcddda9fbccd8bad3da94f0252d031d164f01ae4c91 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:cdbea21a503e421892b58ad502b7d913634286d1b2c0472368de325d513cfd89 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:22ad9d2fd14148057e24cb435c39693079d75dce73f0f12c71329d22e81b81b2 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:24c69baa25e6d2144a92933448a9c5a77978320e51ca9b1b786b6ce15c983538 |