dhi.io/cloudnative-pg
CloudNativePG 1.30.x (fips)
1-debian-fips, 1-debian13-fips, 1-fips, 1.30-debian-fips, 1.30-debian13-fips, 1.30-fips, 1.30.1-debian-fips, 1.30.1-debian13-fips, 1.30.1-fips
sha256:5479bae0640701cc13706441786274cfcb5c8e4dc0b0ad800ff6c69117191d8c
Manifest digest:sha256:2f6958e691500b4067ba293c7ec479f38454b3bbea37005f725fa50ced6fb45b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/cloudnative-pg:1-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/cloudnative-pg:1-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/cloudnative-pg@sha256:bcc99da0b1dc67d22df5322cf0e83ccaa5b86b2b574f8ac4213489604f08e26f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/cloudnative-pg@sha256:f232aa24eb95619d3bd2ce9f2ea0cfd5cfab86782ca8b519f9df0e1f3b51b36e |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/cloudnative-pg@sha256:b8d13a689016d803d5516d768cc7a052806b9e78217650c244936706a13b4f33 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/cloudnative-pg@sha256:1d8c04f331f69bd2e694de51933c8f9b65b023322669ec14bf08f98784449ea4 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/cloudnative-pg@sha256:4f1668e8bd952857330123fd4c3367f8086b9abc434d35edcebb6018655da1e7 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/cloudnative-pg@sha256:75508abfabe3945d4f5480eab03c3b5bb5ce4316c3aa4d28fdcb1fd6b361fcbf |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/cloudnative-pg@sha256:ff6b115237600e0abb0b263f0072608a45cca1baac349dac7f3c8bbeb4a553bc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/cloudnative-pg@sha256:bf9fcb8d1bbe007a1db69065dc6a194ea001d626c11357730c8907d1fab94e4d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/cloudnative-pg@sha256:495d9846bc0b59941a1a26fd2bb3a5a894a4a81aac94f709c013a05cb7c3c49f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/cloudnative-pg@sha256:a7ee15c517f3c7bcef10ab54989b7b980163ab91d95a5661b518017e842f8ed4 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/cloudnative-pg@sha256:5b61aca9556fa015d9a0e3ace5ded82649537920a23c9889540408e106be5a9c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/cloudnative-pg@sha256:a2c2917b84d3d071560b1e0669407ad458226f7ceab74f301826c19f39fb2df7 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/cloudnative-pg@sha256:a05f4060056dd890596144cfd6422caae0012d1dc3de1d592b6409fe02c1369c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/cloudnative-pg@sha256:291baaaaf5576030375d18f11b5f5559573ff6770b92644373dde589dabac810 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/cloudnative-pg@sha256:eacd0c6886442866fec3102743dde8025c0540c497e6f7b9c98db77cc1d0c4c3 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/cloudnative-pg@sha256:9586e00a0bd36438d5f297044f8847913e6da90ba0f78264f7fe8c47ebce285b |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/cloudnative-pg@sha256:55c5388069882f98dabdaf42c5f988b8e1e86fa253f9049b7c9978c64beb6818 |