dhi.io/cloudnative-pg
CloudNativePG 1.29.x
1.29, 1.29-debian, 1.29-debian13, 1.29.3, 1.29.3-debian, 1.29.3-debian13
sha256:66d811db7f30825b4305d0b6a0744c8f82871f5056cac635a10d29de9f4551fd
Manifest digest:sha256:513edcdfda107ebc82337852c07830d2846a6d3f9309655582882fe4fc0bce1a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.292. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:82338540867df7e22303dea94e9f6b564e1f5f8389f04f4e688299fcf077f4d8 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:1a54995b0bd77a272e16d6fa42e963f23e8381e2e05834579f03a81e9941bc70 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:b5a96e0738ab509d2a0e1aa2f5230df239c6a9f26ec254dee6b2e3fb4d5560d6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:187e0b5a8a858da332b3821eaf62dad4fa82788bb21a9b5eb75ed45863c1f424 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:314267230dda7ce20f490d69b16d568e7e7f3430e29da3e978caf3a115b33394 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:4e1a475c946bd9837c77b1df94a6c7288040c9bab9dcab14227d0b0583804d4a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:a5da266c5c2d2befaa72ce8f85b55438e5e17bffe1c2e224f54fb039fcc76a3c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:b4e9e8e366b5c36568a2af7e104268d8b670c19c5192e869db881c9303f251bb |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:d972d6595551e0cdb2d3cb9eff92d25a5f35384a57facf4e215f145d4918066b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:f6787a7aeed87d6c4a9be8935b5eb821395e4b4d176fe3917bea8fd152b9949d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:916f14958697f559d19eb9926976b31689d66cdcfdfb05804cf1a1dcd55cb39f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:41fdf5e97a896c265dc5022a2bec8171de70f1e9cae99b20eb6564830337460d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:9bc211706e84d287db4b0edd91b59cc5edbdf36506b5bcbc8f163eb66b457670 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:23a6e6241b2784413afbbca3a0a10170b6281c6baca00f5f8209d281074a046d |