dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:84a4a0cdb36d5fdfd3a2d474244ecf19781ee9e0744b958e41722695a4a7a32d
Manifest digest:sha256:48b8adf11514d26e1c73944d134a09e969b750c7f9efbbc3abce5cade9ea25ea
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:690260b3713d891b4957f64831f3f8de47a1fe081d045df5c17ae0aa6165c314 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:ec090aa8eb80252ea261d94bd89efeeb2164a02b8a2beae684a6924d6703d574 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:91e5cd66da0639f60a0677c70a96b40290468f37e529c908ae5328c78c2a8884 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:87f508b939d4301aced24aa61e5dc8c1aca63d0087e86cc5be8e17d2522b6116 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:959f3d7582fb151a9b12b65d2b606a1202e29ba90bc7710305ae69a615edea21 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:76d5414055c15bd79c4146bf5398291cc2ad5e8343b51a6843e31480aa4337c9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:3de2a7ebe2ccfb0781693f550e6ba9d0628c79bd989a21dd28b798ce40ae34a0 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:bb27277079faec502c50b07a2ccfbcb59f047c9a236758a6fe6ce116f47c1541 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:0693e62be19814b332e1625ab372c1d66e0936a92ab0fbc46ae2d8932770b20a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:089763f760039e08face1178976911cc39bcd05715645e2b9203e55e399f55c4 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:eb0d6952fe64e758c12868133a4bb4528ad6a66dd4cf30945bb81aea2a71c636 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:c8fa81e02b03c3cc8133d8a9d12aa66340ad8b5ad5fdb13ecaea64b1e72e0777 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:2537f94f02de49b5d694c77ac99a4fe3493a150e68c84a59c293763635aaf516 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:7d8d17be5d4b1278b1016145907863cb74ea9f8de7791c22bf122561593a192c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:6b3fb2895a459b81f7f289475e01784bf70bc6a38f969b52b35d69c656d2e2fd |