dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:0c6ff46ec1f83cec3713b1997457f39911d2c7967c1311eb4672e8ae62bbf25a
Manifest digest:sha256:768b0de07c4bf034f2d718a3c247bd81e338e6467ec699d0778f9202af95f9bb
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:5bbb9d7a36ebbb2af754301ab6ed0678f7e38bf60f37b026f9ad958fcd18b4ee |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:35c40e3177e8d892e53321013e012f12ff172ee1b04f44736b1d2047c9bff890 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:c1b10949d4071b12a1ef5ff7cbb46890d35fd9b6c26b7cfbe5a3fed70b7bab19 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:1894b9c76a528534b4d9b15df3c0b3dbb2774d1d3488fb5ce46bcca33e7d947d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:74d397bfe6579483668e7353f5436f0a526206fc4010209464e24d48f69b0adc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:237ac4db8512e3f436f69a0e38e91bcf2302b206e9669e1ea68d6de653004a46 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:ceef155da404e7a154329379cb1c6942802ed5af8a4d0227a1e42233093b227a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:a5bd05173e26ac23fe6856de7e29ec0de95f33aafa649eea7c5493de63e611db |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:b9ef3cfcdf9c2d073e51a986a269f494cf098c39c0de1bdc9f6c40d972d519c1 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:c84c4ae47bad36d3f60b21c44f55bbd2dd799a9b216caa2493d863c495396007 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:372b04dbe606dce278c0d3b00523db8805281cefcca4eab78606186a382ba108 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:ebc73957d3793f513cdf66792870d58c6d5d7d21f0c4c36a22340bba9b304cd8 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:c7160c8f431c73712cafd273eae18ad5906f3d4027e770b7bbed9dca8af8ce43 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:3ecccadf21b91410c758d2aa7a286fe960a988907cde8439c83a75b293379d77 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:578e473adfd41b2ec238eaddb2381ee50b6c5e7eca21e7172c653bc0eae0795c |