dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:50a6c46bb7a1548507ad5d0bc603216d1b199c5cd81f51aadbec8b18da0105ea
Manifest digest:sha256:0780b3baf47623937b22a05797c5bb203ac54e733ba01da48950d8d8ffad6a39
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:4bad413d9d29b62c44ef98cc7fc9555d3b10bc09d2a925a4cbd35c4f3b08cd98 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:17f2f6e36ecec410b32fa09cc72ad4cef901797af9c7b5d75ec0b9a58fda6e0b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:7c3e6f0ba7e39c73c68faad2a29d350d2c1eb286f7fbd1d3ee741c89463d41c9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:ea070d4015d620f0511ae6cb79430a26c613a927ee66c3c60f4087df65df95e9 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:377edc6ff409def37acb97cb64231d5c84e13468571ea726b0861a60474a793f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:38ee7897dc53db2aa07950060a7e4068ba6b889ac9affb8f352a4ee83c57fca8 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:755e472359ae1e30ab2aa9251104c2b9a2af882758d69f573edf065633f97a04 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:26c9f3a4117ddc4c05ffbd2d8aaed46a7f004588b1aad1f2d5f8c7696d0505be |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:e851bc5ee22a7693c1af83330edd6a50a878dc97363b2e7c417d20fae63e8464 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:1d06f26b681348b8e6462dc1f2fe3be7f922a33accc366f42f9fa7e4312549c0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:9ccdf2efbb1aac99d93225cbd357011d8f4687d9b2f3c5a7bb8f8205dbb1aa72 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:acd6d182d99439f5135df129db214d44cb2ff21eb9a929fbbbf285913a48621a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:3fbce2c09a92b8c2eef0115cfa0956487d97093323f809495fe04a9257d2e956 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:2c3a252eb2522cd38ecf5dc6808f4ea81e2eff0a9ddf6c0a437bab403fa3fda4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:7c75c4682c9df00138430009a89f45cb0a4db5140e728ff05688dc8269251601 |