dhi.io/cloudnative-pg
CloudNativePG 1.27.x (fips)
1.27-debian-fips, 1.27-debian13-fips, 1.27-fips, 1.27.4-debian-fips, 1.27.4-debian13-fips, 1.27.4-fips
sha256:ed7c6a6241898ec023646ee4b565092e195274afb890de91d197a3f7a32b2aae
Manifest digest:sha256:47acdb2b58f2fad5db985c9afcab465becb75ea5d6863b0d43eb892a42b879e0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:067479896de4c00bbfe3bf6544c6389f0f22a6706b5a2d540fb87f430ab7b5d7 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:6720a53ae6371100ef3fa607146edfb2c4822b8fcc72becd794175585bf23a3f |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:2873a79055c667148b83f315700f698a85bb7820ed02a7afaa66f943608cf644 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:7ab2d8a6a4c0632b96e2e167b89a2bdb0f4eb148f9651856db1585e7ae0b4ae6 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:8ceb30d4a7bc0659104f91681d7af3f5521c583bb33dd747a35a4aff0c422dfd |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:60e0d2df373f425822816f1eaccd80a2012a6c708cebf9c30e7bdeb49e423200 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:a50759332af82b67ca5f9084499401010700d293c36b303628fec2691178d2f8 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:ec63a9bfa59f75b3e676f08f03b875728a46d55b0883d6975c9d5daa73575317 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:b7fdd15cc86fe71d5e4766fcb71161bd6d7c04a4dbf5e922e2e34ce9446267ee |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:73615006b5e46d4354e411bb2b7cb392181e4cb4ae435cb4b8c27e06a560876f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:10b2e19226021c9d4f0fa1224e0da5a35cfbf2bb04d2c8da91f746116ece6b36 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:dbbdf533778624b36f4868bf68bcfbeef618f3c83f4b66bdf20cba9ca945e5f0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:bb7c53059a515d8614cae73e80d7d7092c7ff342d5949d3333d72f5f3d3be1c6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:703544f9dec4ecba3dfd8e640fbc95280d6f376715b376930f3bd167b42c1ab0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:761aa8a5ca1864dd23801c32f524af3c5af0d63ca2fa01c31c741342c02ce3f7 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:fbc74dad2371cb061ef026132803ce8feec1a7ad3a7a85a3cb47b0c560f817e8 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:b24f7ea4e66337ed13682e39e173a51b40c4b8dce906dace8bca4adb58efdf3e |