dhi.io/postgres
PostgreSQL 14.x (dev)
14-debian-dev, 14-debian13-dev, 14-dev, 14.24-debian-dev, 14.24-debian13-dev, 14.24-dev
sha256:b12f000394e82c076ed4300d614cec2f2706da6377df27dc90d1462340641082
Manifest digest:sha256:49ac8e4567bdd6e8e22b3a417d95807d9dedb7a847ab2c56d50aa47cf3b1e173
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:bbc34f943f84a02fc153c083f756121ad3fac49d2c40ba7733b40c7d4554ea2c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:1b5594582e5011488c045283908f15834ad38f13e72c79f3497b3c94bc7dfa06 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:3fa12059ba0c8d1fc92f187a05d7c963cc3c496a8f33ea849e63405cb93bb070 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:714ec8605a75398be357bdb7016d1f571ff1cf73fadf7508789c8548241e01fd |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:ab087c5fb3b753ce3c53a24f19d24c30336a1c52f05cde5905638b9e3b7ec9ee |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:06013d3b796856cac5dfd6fc10af7d1d6e591218a242fdf802e9400eff7001f0 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:29a9fa47cc1d2bf941fd407873dc28b4f816bde979f2cfc1e9e3ff7d58968d29 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:fc4c4d58be4d870bc434203eb1f26863dea53a3f42d8b047a3428a5526163446 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:446b73750e8096687b90b1d644fa76cdddb68523d05745b17a4fa9c2dee12f58 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:1a501d650e97ee9b4e4f28fc90da34741536548721b72df48ae193317e75342b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:d783b53aa627f6acf41bc11f55e460cbed1f078ab419bf0dc1c976ca57442945 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:36f7e766cec8c7a7099c7ba3b4126aa7dd1b9f7d367b56a08c54a52770fff358 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:b307d4ff021c7ed5a19e794f35d16c4d7c98d1c20a13b20ebdb9712f06b945b2 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:3c1c92d27798344d39408afae6933a81a4d99944ab48f7b3ef7f2cdf3998a8f6 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:55fbf21b8d8128ebf28d763a74c03a2e44ba83e81426b3a95d0798bf2355ba9e |