dhi.io/cloudnative-pg
CloudNativePG 1.30.x (dev)
1-debian-dev, 1-debian13-dev, 1-dev, 1.30-debian-dev, 1.30-debian13-dev, 1.30-dev, 1.30.1-debian-dev, 1.30.1-debian13-dev, 1.30.1-dev
sha256:9aad34c72632dbd8b5d17c9078ce91a120fb18b42d0a6a7be477f804d6a60935
Manifest digest:sha256:4dffdef7b43aa48ebebe1d7a0bb8a142fa3cbe9c3ea5e6f9454236688f0c33fc
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:6faf8fc2a68da15c17dbca2227291414433aad106a3846cfdb2f9d88f384c938 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:b73ac8a8b122580c4f7fd37618be2525ac7f30207677d3cb8b3b95bdf2253863 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:12d05801a5e014068a8f4be0a22410d7934c8ed7e7948a02b297f1a50395c1ea |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:363fa2b0c87383bbb3abf827b3d3451ada504de177488128f92e923ddafaad1c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:47b9f7c6d4a180df82798f6da13a6a99faeb67a461083a69053b0c210b563e1e |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:2fc53f52a4f89d2f26dafef148e52d294ecf7d77a4ea28aaaa3f7e5d2c0f4973 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:4cec19e4eab002830aebc01e1fd33b77ec99f856064771b841b630bf8a7bcdce |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:165af7dbe24f0fb3e32df49bca80b92aa41f039b37ac775423e464df0b931202 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:78245258f65e3685c7cec8b724cae05ab9c08e9376b7e4ab62238d5d4993ca45 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:d9cb552d04fbfc56c7df26e5661ce15d52d4d87917cf7058d0128c5f1281f5da |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:61b8466f98539de142ea9d00898068ba9fa0f1304bce61db85127db32af66e74 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:f13b81c8f1fc638e386d4b6d1534d0fa3935c47b05d58a96473a146a4a8a4cd6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:cae99d8b76fff0b399f49e3538013e43f8f70ce54d127a7b305e054c4bb694fa |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:3bcfd7f1682ebcaeb79b02804d9b7215aba1e47f100a190edd6803e93080a5f9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:3324a7a4cbeec92611d850613b0511ae3c21c6e3aaa3ecd5352f03fbc33d6a22 |