dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:fd86ff3e483231dfebfd4af83d15aa56f9f920cbbdb877889cb5e64fd1c015e8
Manifest digest:sha256:14ae64b40c5e9c251c53460177c3446094cf79a6943111c636478787922bd46a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:868988062a4ffd8fa4a000c06a3c46f418b45a65e7f6112c0313e012fc28ccfe |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:c57d28b568e7a7850ed97df3a0b6f5d193ca5854c2b575da35844d40e863fd48 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:f324bf3d21bc124006a62552502a0592ea06a16583709a35e6955dbfbabce4a0 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:a4405e6b337a82d376ac1eefddf35da8a7a73675bb9c48fc37b541b320957696 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:4136ac79dd7c322ec957c48a558c0b5933c2b49f6e2b3ff0e15bd57029225f2a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:88d3f8e582618cc1f0df2adddf5335a0288df5b8630ccebf51962895f5253230 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:01dcdaff9a673ab390c09be69e4bf55cf0945cc035fa4d677ac6ae89bb3a4ffb |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:2629994e8710dcad85e313ba8587140d33d4e4fe62cc1bdb051f00d278384e5b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:120a8fe1321dc854d099f3ffa9129d9032a948b3d0c147a1086560f2fd214949 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:27ce0b942eef7023784007a9f88f8b07cbcf27f9bf7c548649761160551d2634 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:d7d9168497d14df2a9443f041d7d359f7f54a72db629d98fd528f87bb2d3a5db |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:3561c6e7b8073a2076a77ed37b3a3451306754fe8c8f23ce68f1651580b2df3b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:5e4677e603df2eb18c3d9e2ababd89e2accd04f45d68953c04bdc4e2ca41e595 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:a263b3b8ae305bdd635c1c5b22cc65fec92d103dbdb2b2d4ffb31b06f0c30cd1 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:4e39c49956ee1b99e5ffde856ace98680f3d40a77a45376c20073cfff00b3981 |