dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips)
1.27-debian-fips, 1.27-debian13-fips, 1.27-fips, 1.27.4-debian-fips, 1.27.4-debian13-fips, 1.27.4-fips
sha256:5a6cf5a5c741ad0bc0e9348d9bddd58d6b25806a6fb220a1a46f85f0bd13d7c4
Manifest digest:sha256:2ac8952871a3adafe2c26ea5cf7150d8910fed0562c55d5a798f268c088c8d18
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:ff30b4e4d0ec128d61fcb51eb95927face96a21add7f6695525ebc06350129b7 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:5bbf374b2ab2ecb8a1d568b29d63121d0fc24bde9f225927f8fe8c1a4778f865 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:8aca0a3b207993bdd960dbc1bf57e4e73eb0f693da4ac0d0330906c4fb5bd744 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:5396630430c14a8cf4f995a524a86ccb18978c9b29fe92284302569db8168f12 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:69e579de2651f77189a6fc7bc6858e44ec92711d4c0a6723c6a5db85096301bc |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:64cb533113b3de3df0802e779f3acf42abfec3a919e62b5d5482963e13c7a62d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:966312c5844b254a56f1ace022b2b04229296c4d59a5a07e93bf91a619708692 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:b2ca9b1b8b314f79e851b00e445da13c540e745bd758cc878588fa05cd14fdbd |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:258484c223626b6a4c9dc35a6e62640a71f497696dfc9b5ee7a0e7e021477bbb |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:871abf469b42bc23bd9444d0ca895b4fefb630cca729531add2841b710f1c948 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:1898e48abff44399b4caeb29b020293668646649129d318eb5efd0925c3d5b05 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:bf6aa1578624d68ef2db1e021b5c768c6cb53fa50f1338b8084130fa08957c13 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:d213b9d6a1b757f260e44b361b94c63bede507b0f00049f5ad70f3cf91594a86 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:8a583862a3bb7307024847821e6e40e8b1af43751901e5050e648d11f1c366e4 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:3bae3853d0abb6ed8b8796612bac9bbbab271221a37195cc8af0618c7b9f9602 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:608588c41424cb3327b93564c814cecae55abe36f97fc2182f723b0056723ab2 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:2e813f00b3f66418fd2a57a978375d4819f65d35e93c863cf0b14a6218896260 |