dhi.io/cloudnative-pg
CloudNativePG 1.27.x
1.27, 1.27-debian, 1.27-debian13, 1.27.4, 1.27.4-debian, 1.27.4-debian13
sha256:6772e8466496a00ba09a3b878ad736f27ec64d8e083bc2da0495c899c7461bbd
Manifest digest:sha256:cdac7aa613750fd5fa4e90d1994d47a9f6783a80bcd1c6aa934021aadd8a357d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.272. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:08c171187360f7614eb613520215f2b36d1e5653bea4704bcb0a7a63e0ca8c76 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:d6e0e405402f5ff458e8d66cadbb3288f7bac5ccec56685557acbc34880a90cc |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:a75668f68f9bfc662f7be1843162ff0e0efd6af3f58c78a76525877c415ef491 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:fe13445591cdd9a34c3676b43524d7b493ed7ac44485551e37d84d95ec532b42 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:ab4cef4935461c8c8510df904e2c1efab4280d375b663a0a6a16f94ee2a9d827 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:b355c3cef8d7d5d20aa3b0a39ac8536ec5eeed0a30c597e1f75207c9594262aa |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:18535fb06b5ee351b7b032ef4bf5bb3babded71264892c8143e8a7a3b77e5c9b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:fc307e52cc50acb6b8080555f72faf77e586d505de19a764f446ffe92f86611f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:f1b99786f3544e1126133cb831f77dc11a557d2edd32e2bd0373790d670a060e |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:9af5e0b09549d4ca939530f30b003bdbf6187551a85fff32e2bff343d14dac39 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:bc97a637177ce37e9652cfe82a79f5c503b3145f50a12f33b42065f39056ba23 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:3228f845b924090b5ff9a0ea476b23a5ff8791883196edf3d0ae44b402eb5c1d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:9e0f2be37f76fa1698e98d8b89ff8e3eb3ddde1bfae033191fe942e1eabc3350 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:41aa9e833b81b24f58d9006f1c56e35981c530e80d9ac2cf29e786c1e8f980c4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:79e9164acc52f604bb28482682e5df077c6127d8a908ab9724a70bf1bd92c91c |