dhi.io/cloudnative-pg
CloudNativePG 1.29.x (fips)
1.29-debian-fips, 1.29-debian13-fips, 1.29-fips, 1.29.3-debian-fips, 1.29.3-debian13-fips, 1.29.3-fips
sha256:e64c882ef89a19d93b2dcee894818f329dd9965a6de9d192ec4ea1a387a2e469
Manifest digest:sha256:9219134e528479ac14fc7e17344a76f55a3b9f8f08a8fe480b7ce7b61e3618a9
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:f87e299aa56cb3620c9b7b23d6be3e23dd059298a482c0b359d5badd7ebae49e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:9621b783da13248ad10589826b7be046c5973b04061bc770fe22bbd0e02e7ae9 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:1059c10cb86f4dddaa8f5d14a052939494b82cffe8e4ede57b43b47a1c7808ec |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:a8c594691e96385389d064de3f5f403f59af3639afa86788532e18abba480fdf |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:e718a166402e21dcf7081377f877d20ff8dc27fc0012b88d1269a0d170a942f5 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:2451e57bb024ceeabcdee083b6a3b51ba6cbe0b2b5954e63fcd0c78d7d97296d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:44cb20bea27e1c5b6f740026025bc98291ef5ae8127d23301df793c08293dd08 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:576d3710d8fa96a4878e54d3ef407511844cfd0a38186b682f47c80e5816b9e7 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:eeace0e030fc89e0b3763a422beeaa595f5bd5443bbcfd7090862b42bca6821b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:6eb7024684aefadd7b30d6b6028d38b0b8fe727870028555e2f5f504c7bc2cbc |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:f8ca371fcb545d92d7cc1cc504465db9756a97a72ec6e673dee414e4ec5553a9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:a9faff8d445fd9184496657d5d6cb4c620fe723ca7198e1cd5d194f203e1fc72 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:499f5b62408ce2c63813702a433862e5ca1d85b27692c8e3ef7255aa645d4410 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:dbe513fb5e6d6c9b56b7e24fd073fbe24cff6d7956069ecd92eb1387d9c7e493 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:0e87ca6339159b8dcf916d1f4a444df075db2a72ea29b45a207d9230dd8c0873 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:bb818711d475bc85a1d18f2fd16e695740291c9e408fb683d57470e4a15032e8 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:aaa19e752100e861c04b44a321d7be1cb4315eb7bdcdf2edc3842150056a07e7 |