dhi.io/cloudnative-pg
CloudNativePG 1.27.x (dev)
1.27-debian-dev, 1.27-debian13-dev, 1.27-dev, 1.27.4-debian-dev, 1.27.4-debian13-dev, 1.27.4-dev
sha256:461260e63ed2e0b5a2d7a2374089e5e4ebfe18ca9890ad7d625aa54d4f35b738
Manifest digest:sha256:e33a4ed20738420e2b333fee128bca8b306cdd6894f9d729b889c21693ccf9e8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.27-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.27-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:a9e47c6ba787bd46a544c8e27927cb84efd44f43c1856bd1d8e7e4bc3c674637 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:c25e0d860990a661b94dcca844adcc73d26e8fe241e1b3f7a6c7498bdec7728d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:f59841c267f8cc24b140a01e69badd4ef2b87df78529bdfff5415d97de221f72 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:fe536fcb668a6df3523cb1470d8629fc748b71717681ee0ecfadc6f0f7017c45 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:406f92fc1269709e713092b6ebc974d077a9ed34351ef361bf9132c874381f6d |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:c1add17271b834d0130933b15a6162ded32902a345647e61ae229524adb48e3c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:4c35c8cf8e25d59a76670d1067e84aa7db772e7e3995f18dd12fe8ef351a0259 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:cb4e09a5ae68f049fa1d55c64a84fbb7027fd0c2cf549124f9894997d1921c9c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:3ef199b5253b553242a9960ff051490a9ff6e9d4104d374753736c2f7d47250a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:95d49138ccba84da7bc003146af8f3e8e6c0d38d196a1daa700a931013db4ce9 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:442ca986629ede71205c5a0d8bbaaf6ea442da9ab4747ed11eac51a4f7f397ee |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:d95208d44991f058907bec9523fabc5550ddab29462c242607f0343f0affdfe9 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:6c8b9471d5deab89226343e0799311dc035526cf122c0e55716c92658db890cf |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:049926276db313997dd775ad83faf3ef0f5ffd2a0ce129d293c868bf7ea4fc5d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:78df2c903903d2cc9e8feee8108bdf4e7863d837f2e13ade7f0269b0c6500916 |