dhi.io/cloudnative-pg
CloudNativePG 1.28.x (fips)
1.28-debian-fips, 1.28-debian13-fips, 1.28-fips, 1.28.4-debian-fips, 1.28.4-debian13-fips, 1.28.4-fips
sha256:e83e63bf98fa61ee99c06bf96626a48a03b82555bc2bb3a27d4fbc333106120d
Manifest digest:sha256:d091f593345d8bf69c0050b5f37ade75b99483ffb837047b571cd71e1e1ca892
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:d7908928649de42300d5d6d67ade43563e0cc6d658c24d3e6ae4dde096e13b1e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:a236a40617b9e3c9925b777731a497e5d37a49ff68b982f91be484df9a6423b6 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:fbd66a9eb3b6f02647d85ec157ff08df93f469d03aae883b1c1c2091e0926124 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:842daa356d65e8180daeece2563cb94a771a0d6aabba7bdabda085705a3716ae |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:00be76935d071d611a931e84da377d860cd1c3419dce8e22e507c5387f1c2cd6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:28f174d6f7f3d747c1740635e49ef5e993c921a1fd7b9f8a0d7e263b82ed458f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:3d6b16d12635c39471c33cf0ba9bd95baa2e86d1beeb814627cef73af8962802 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:25a956033e45c8690983e30e4b4c2ad6eefdc3dce45379e4a88fdbcc535495b9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:05a85eab0ffcc79787ceb42ccc9cd95fac25ff1c091256da0f0ab3fbf0456ae4 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:4070984f6b8b998ae2c8e5a9594f94c9618efe3df72e3a494bd59f6c6897b249 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:91caec995092e1988d8ce2f13aade8bd3fd1846a01dd1896ef763da75af537c7 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:04f0516fdd5f1249e52c2a478c73ee0abc3d460dd9652bf9699f65671111997f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:272886d415c9227eb67bbebdac69b99bbaa10c68a5ca70ceac2737ae905eef8a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:8ff2fceed901085a759a7feac068cdfa1c385ca8165024e82b2d1c5870ac56fb |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:4eacaa58c4057c7825db1cf7680af8beb50c50b32362839784462fe6dc9c05f5 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:4c604b519a4cea055ccd4a6af66f67f37e8dc445a3bc12d2fa79dac0faf5cdc1 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:bb26030826b8b870ae354af128c2d1bb884f80da1bbc9c9d6be2bc8ae3ad19f7 |