dhi.io/cloudnative-pg
CloudNativePG 1.28.x (fips)
1.28-debian-fips, 1.28-debian13-fips, 1.28-fips, 1.28.4-debian-fips, 1.28.4-debian13-fips, 1.28.4-fips
sha256:f7f4671c7486dd9a7c2a94ceec70fe33cd05aa34191a7dfde3d0d414c446611d
Manifest digest:sha256:dfff98ff25b5bae4c17d341df9dba059297631a749b6c34d9305627b6cf4d587
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:852bf6a0369880c7af183b1c6d2e439a25407cd27c488a1d1cb404749124a170 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:c17d89c2e4bab1ae733738b374ab3a73395e8a2861386a6e68b8085ecf4da525 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:312bc21ee3d31659a2dc0a5dff2e4ea19861aac4dd95475a711a6a4ffdfc40ea |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:9b24edfe69ff9341c756f1de7da13058f627db96820737b3ced10cbc7f64ade3 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:0991c7958fba943b12e81b92cb435e5ae5e099004718d36d3ef75b1619420357 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:335f97b4cee82e38f6171aca70daec0e672baf6bc882baeb9d78f8253b21a69a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:e881ab43ae6d823d1f7bba3f49c50033faefb32f666ec3f2ce23a6c44b885225 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:90cc822db6f5386bcab28497337ef891aba026fa7dcf4921d698806baacd615f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:82fb9b8881e435432999483fb9a7e1b17e275a660bc9124b0a5cd4b000b542a2 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:445462f5fa139e11dc0da8d9730c149c96ef214a4abbb755660ade6cb82f1f99 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:9dc6af5e183df537b05412705e39f5e20f276f38ba51d0df7e24a4f082eab33b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:167860e4cf2e489a8399714cf9217dc31506bea7102db33365498ca1abb15df1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:ba9d1d7f8cd97e3ed7659d225b8f6c4bb8de472345c3b68a0093ef1d0656e742 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:658f25c0ac87b568219a3585e341f8f470002bc67fc47b32d530f53cb9345a53 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:cb03ca49e4403e5eb94fda7aa247250426791ef5d25979e52575671ce05f24e5 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:f6f7695a2768693ffeeb17e85fc96742555c67bcab2098b8c76cd8e0ab4a0784 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:4760658167cbbfd69c6d4ebe3c694a064092714b2df6fe7a7ed42bc17af749a6 |