dhi.io/cloudnative-pg
CloudNativePG 1.29.x
1.29, 1.29-debian, 1.29-debian13, 1.29.3, 1.29.3-debian, 1.29.3-debian13
sha256:9a3ff12bd570fcc50bc7a3d9bc3e8286be3ffe89f93a8a599f93d459197e0d51
Manifest digest:sha256:e6c353d87526251bbc2638f2c689c55a925a1f5aaf1040e6bedc2ffdb229928a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.292. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:4c685215656c16e7b0d54c7f1cf579153ee776b51458d303e1d5f0e8942911e9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:ea05a032edebeef5fe3d5952081b3411ad577850283c5b349e03242ad7e01acf |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:2028ea5d0d9c85deddc6a428fa7b0a923dcfa4f91e8c28d5c328aa5abc99f661 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:b1ebeb243482bb35e11d546eb4be721bf8a4e589c363e576e7d0dc458418639a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:6695ea8b8de7f73f202a276a7cce9aa2d5fce1f8876045d160e1e20f160f9a0a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:7c344a6f5021ef0be955a6c454c52192cb65cb9bdb23c8d6f8a7cdd7d184722b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:e9eef9376d8e19f7ec541cd14006a7d51fb48abcf1aa2ee87082d7ffdd8b10a6 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:2b80b4cd041aa0ac60bef52bf379e5bc7489b86a4a64b7c008f569a6bfc634c1 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:0310819e01f8057e04fdac370ae6aee03a6ecbe302b1b895332ac707e2b1ee34 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:cee967bc79ef8d47784795e02e6d6583c6af110ff0fd5c52605c0a5b8b285f9c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:d7135cb95e677aacf3626e18cb8d815fcae9051a570140d3f051e8af5fcab3e9 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:01fe3c2bfb72afcf04beb7195dc641488ca0e2d0f954f6b6d21d6867042e3eb9 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:e360e76ab60b6fc7f6571f59d75bacd58e53af099b2621d35c65052923d81318 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:dacc7dc001c0e6d8ca1df6742a67e8d00e134ffab365fd85dc46cf6ef2d831c1 |