dhi.io/cloudnative-pg
CloudNativePG 1.28.x (dev)
1.28-debian-dev, 1.28-debian13-dev, 1.28-dev, 1.28.4-debian-dev, 1.28.4-debian13-dev, 1.28.4-dev
sha256:977ca238c175f88159dbf56740477a6849d112b4cf180f3e735129c4aeca772d
Manifest digest:sha256:0010d0e2070a1bcdc5f852b58872acee3abb71a5335e8e0bad24274a173b7d3c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.28-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.28-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:bff54e64ae4fd59a4b1b189f53700ce223a35fbc413a12f54162dc839cd4a950 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:972e784f4409be43bfeb179fd35543dbaa0e4a247da5a1bed0f55b035a91e2f0 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:3ca5441fee6fba09e956110de9601c41c6c703a1cfba0a94dd71be919c94416f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:3e8829ab52147a3fd2ca7e2d1f71e92e0314348f1aa00dd4d2392a857c608539 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:b7ea6dbc4b1d9c2d48408911cd0ea0749c30279d4027ddc2c8ba34b84faceeda |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:275deb0e594b799b153ec39f56d8999a49be14c579d5b3b72937123a139079dc |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:70e2c265e232f2d3fb51e811cbf635517195d8ea60f10a77666390e483e6405a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:54249e656a86bead51ef4fcf7f881c3a02ef4285812cd24d22fb0295e1337ce0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:2297379377100d77f16f2f48be48e03b78123822f291d94db3ab31d9b5ae256f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:2d3d1661f303fc72d159ccc9115217f7b6ff89792c9d294bc39d62195364b6b6 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:011ab016343d8a9bc2fe3ef0e0038d21bccb1b80331b72456e11ef3ccd36d8eb |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:a56bab86b814677edad3cf5d950680767c774da5bd98aa45a1eb19c9329878b8 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:f8d08299ff31bbec021398288b9a203f22471948b32062f6290ffd6beb4a3fef |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:4ed8728b36f2f075930af43c9487fce51f4159c332894e600cb61118482788c2 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:b7c1bd19d65e784e4aaedc2f061c5d283e0c47b58db85d8ba4dcba1636664e32 |