dhi.io/cloudnative-pg
CloudNativePG 1.28.x (fips)
1.28-debian-fips, 1.28-debian13-fips, 1.28-fips, 1.28.4-debian-fips, 1.28.4-debian13-fips, 1.28.4-fips
sha256:f155f520b6d74e0e291e0b5d182336d173bf05e7a32b22ad07797d52f50c5b6d
Manifest digest:sha256:594ff128910845d7e5d4452366cff18123fa8755e95fc04b6112cabc0f14f834
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:c0f26fc205ff2e3a20e4a59fc680f8c8504ad472fe081afce74158a5de411691 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:e15043c6b05613d8bc43949c59e5c2bdfc79efc8d95daf6d27485ed982e94839 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:722dd2cfdabd6978122378c4ff563a40a74d34a26aae4673026cdb326e1f262c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:ee9ccb17b037e2e374929c6d5157e36df84831d09f3a4e8a51245cfc14da32ab |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:8af3446b5f6320217b5fec01549a8e7cf31755460334c46c75d2391744ea72be |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:b0de7f8d109cb0c2da982433d912d9798b4a0e744abb9f0f59ffe07f8b8abb5b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:704d5fe79f4905cf10624f11611fd0e9f239efc891d9f1a37b5d6bf0bffc3473 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:fa5df3e177d09e18ed137892de309210da54c4bbf8d7bdc5835e8d0cda99ec42 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:67620f7d4621dfa0dd6e9b00e1a64a2bf2b9906b565756b0e5b5dfbc444b709f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:f4068a24cc52ac9a7d95a01e2a473799e6fd0d1f9817eef7855d3229bd6e217e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:37ce817f1d03f7a5abe5145f054ccb92fde30736e92156832b3e2ad0def5e4e9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:ea14be0c5a61c1b508d8eb0877942feaa98594091f75c479a65fb07e7de837e3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:2dfdf33d42955c1b471684fdf78a9e87c087b19aea09927595942f233c17bd74 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:e5fd430994b71d088a141f47aa6dbc1f9156c55fd7315cfcaf0a5cc5d2e14752 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:ce47c22a786948dd5da8f548513d252e080c8454cf5b6ec04ba3dee78f9cd304 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:4cbfb7c53c8b561acd8b0d577fbc7b4b06e38da0c7ca66ce0ff3a37c5a787390 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:aef9cb21e8002e9742003d7666bf40594e955b01290436cc7975af1d44e6702e |