dhi.io/cloudnative-pg
CloudNativePG 1.29.x (fips)
1.29-debian-fips, 1.29-debian13-fips, 1.29-fips, 1.29.3-debian-fips, 1.29.3-debian13-fips, 1.29.3-fips
sha256:73eace882fc64cd2104adad7fe98157ab9445ac3007cf8d01bda9170bf5d23da
Manifest digest:sha256:fba26b410889dce0a7ffa48c83c92f294058e20d4b1fd3e1844fc39f1299427d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:885a4c986f97af5d86819dc29f43b3f26f9f75cc571d2c0ef0eb5083b0bd39da |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:d40c5d16a1a58e3f60960482ccb116579808534974c5b2bbea0bc1e022967f11 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:91bfeb57a23d9c11a98a26d1abb6b6bb12a20515990cf029b934a0e6df661c70 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:1ed6c61efb7cff8eac56196f5e204985733875bb758ba29661b26fc1d69e35c1 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:55c857d2f1494a6694809fbee90c0eb7d31a380c09505f82a4453b30951d2a9a |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:feb8a8258b914927723267ee3866e8c5f20dc34486ccbff86bc2e94417c9262f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:9d9d2e3cd349391d1efc286a37f637312dbac139ba3e46e652ee4e822d0471f5 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:516cbb2844aca8bb7a4ff0625470c82acc0934c891403f453f2381c6e5a0ab07 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:114cc23875519589f5a60efe03fc4507d300c8bf895d6a3db97b6859c3264064 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:8a1ab1e240c38a390c21a4a91805e56a7e2cab8ec7b223f3b75c2138e5b23a31 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:d8fd505e7f855758c18ec586d4c1af7d8ac67f0168acc2e106b51f44120e2f79 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:eab16bc4f32d4ed96c54836bbd1f31c3ad5910db456c479c2fb272e0f5387821 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:2d7ba5e6190a720e2da296a165e2e1805b16facca2c517050d545ea4b87cb904 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:bfa741a0c916b0687b26abb069e7c8f7c8cbf79d02716db73b7a74b96c79dda3 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:2d541b397f5b244fb75b9013268d175bbe9249e625e5d81f344f3fe2c7e952e5 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:ad7905b46155843721b273e58d5e5db6960ff7faf97b298119bd551c62fd192d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:dcb0a84ef33913786d77a82be445baed0d63f0d1febbd5d7c7f159c783b62f8f |