dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips)
1-debian-fips, 1-debian13-fips, 1-fips, 1.30-debian-fips, 1.30-debian13-fips, 1.30-fips, 1.30.1-debian-fips, 1.30.1-debian13-fips, 1.30.1-fips
sha256:5479bae0640701cc13706441786274cfcb5c8e4dc0b0ad800ff6c69117191d8c
Manifest digest:sha256:2f6958e691500b4067ba293c7ec479f38454b3bbea37005f725fa50ced6fb45b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:bcc99da0b1dc67d22df5322cf0e83ccaa5b86b2b574f8ac4213489604f08e26f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:bf82545c02eb73a84e45dd9ead8b072783a002ea5793b0491b11489b8c356bbd |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:b8d13a689016d803d5516d768cc7a052806b9e78217650c244936706a13b4f33 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:9675611fde15b5edd723acdb3643ee4f6fe4c101c44d37001295bf847f77b7e3 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:cd7a0dfb5eb0e6de758dab086106cd236bd4608d3b356c187e9ffe18f2dc6935 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:ae3276a3310a0b268a749d94dfc9a9ba63a768fdbec6ce925e124a499eaad5ad |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:a3126b4c40425a8940aa8b86c3cf11ad8032f218709c71fd0bf129db68408837 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:bf9fcb8d1bbe007a1db69065dc6a194ea001d626c11357730c8907d1fab94e4d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:495d9846bc0b59941a1a26fd2bb3a5a894a4a81aac94f709c013a05cb7c3c49f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:a7ee15c517f3c7bcef10ab54989b7b980163ab91d95a5661b518017e842f8ed4 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:353ca3484d2ced7488f14c02b7d1c43ef0a16e5a9bb2a34d65a7de69683e8669 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:a33e0f8e2cf18933eb7b26f7f3101c799d7731b5d78222fde92718bc5d679a57 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:6f88f51cb26dd3a3caa6dd661c50d3516e274ef335bc30bb4edf7fe8b0cfc491 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:291baaaaf5576030375d18f11b5f5559573ff6770b92644373dde589dabac810 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:eacd0c6886442866fec3102743dde8025c0540c497e6f7b9c98db77cc1d0c4c3 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:9586e00a0bd36438d5f297044f8847913e6da90ba0f78264f7fe8c47ebce285b |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:55c5388069882f98dabdaf42c5f988b8e1e86fa253f9049b7c9978c64beb6818 |