dhi.io/cloudnative-pg
CloudNativePG 1.29.x (dev)
1.29-debian-dev, 1.29-debian13-dev, 1.29-dev, 1.29.3-debian-dev, 1.29.3-debian13-dev, 1.29.3-dev
sha256:67a4570d90f696ac07be4e7d9a3c26998d2ec0f40d3176f2eec3e0dfa1be8abc
Manifest digest:sha256:b7d9a738800b2edf1d8ce109f569a6b01993afe38f728c2d86f3e5af55ee9478
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1.29-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1.29-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:4bf465cc80f6bd3035f3395843d78878569bec471760744cd6b07c383e6c53c1 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:81f201ab5f17a7a9c5f604532542fd415e197a0f664a6302e379e3f1e8c7e553 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:98e06974b336c729641298a48f1c199c8c0fdb000078b1f0e82706c6c6eacd6e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:1d47bcdd4fb309d66c92ba49565725d0c8d13d99c0b9aef43eaf2451fa6c8c85 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:38a29e9ba9469d08ff3416f906e67c0394d288be2f543918d30ea8add6a45a58 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:9e63bcd57050379513ec95cd3e1cb9c4e0d80ea93f6b648815253fb1c6c7b663 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:58f5b2b28cf360e1ef7f493524497863fcd82e4156395ed9cb2e18e6a14ca534 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:0794c09c9fbd1fdb60697a73a47d72c5a69add6e7494b4d386887aa71269721d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:1a5b8055193ff4caa30d717923d0ff8be2ec81e4e24584ba7a6be0aa4e4dd046 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:4639abe2e4324d4fb40ac7648b6c632a5c3ecf8b5922031dca3eda1071a02d4d |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:4d9f442d65b152618ce18ed3d7d377a7a06e7e94a0d16194e2e90a9ba00c2766 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:fff0a968ec9caca1b987f2830a3bcca85de04acca985c63119d817fe6300f985 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:bee3b59549bbdbe5541f815e00c619caf386988f622ca6bf9cf0c8d32c1e258f |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:cc08e271ee3bd4989640347f1f7b5fedd9059b24c99a7cf06a07ce32fbddbe20 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:60a0ab920d756aafc3edf6bdb991424e5882f0df3c20ad999d8ec1ac63ac7351 |