dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips, dev)
1.27-debian-fips-dev, 1.27-debian13-fips-dev, 1.27-fips-dev, 1.27.4-debian-fips-dev, 1.27.4-debian13-fips-dev, 1.27.4-fips-dev
sha256:9f6df7e5b90b5658256a8a5a9ab9f4d1d795e47687e54aedb196e1cf082a436e
Manifest digest:sha256:f5f8ff200ed8f8203c5aa68aba6831164556e8b104e98982b84cdd3c8d2c0a69
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:c49e172856ac864e931bdf6809fba21c17dc26453eb334618dc070915682f0e0 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:6efac3b9e7b77c2b65b4dbd7e5c74bc8795ddc3667e57093516a958ded3286e5 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:59756ed6281524610c158815f442fb109dbe9873b175c96d963662a4d7b43af2 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:58762817de4105f56724c6dcea6ab838ea3826f02f572fbc6b366870b43822a5 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:12f52fc3a30702980e9a6b8a2bf2e6672143006822e3a21fe3385d953efd864e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:696f23b95054329831d4a7f27b8fecb65735a683f6f7427acb018f8dba3b5a48 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:71287f1bd40048ced53a1b6351bc82494d7bf87986d609c2c2ecd875f6a6996d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:762d513287244edce2dd0da2f735a4c5c0c3e1fbcc5b54f553bab3226ceb35c2 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:7da46cfc57f695d6165b46b5ac39d09f46886c8ccf974105d5746190a75b1d46 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:60e266e6b28a3cdc3958a181eb9f7daa18c54dbe4e8106db5e71e57e460ddc77 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:058813c4d0b31e07cf7955d0eaa7190de1a0951dbd03740efcb0dc7e8b91832b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:7b36fb85bd1250c7ed475596003b0e6492086b50aeb6a47992c2f28e28b27070 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:6d3f74e928c7b008010ccca94ff85867bc355f80c546029176fe06b257911905 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:9b3d891f552d330a54110e16ca4d2459af512bb2531554dbcfff3e426d889a38 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:15db6684768366e0395e07199d503df66fc741d6c715662e59b999d50e185ffb |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:3a178e83f4c9dd60802b92726abeadb6b19c29fa08c7714aaabddac10bc268f7 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:6bff526ae17f4ab3702d24f959336b8f94faa93a057d904f8135eecb24c2a11b |