dhi.io/postgres
PostgreSQL 14.x (dev)
14-debian-dev, 14-debian13-dev, 14-dev, 14.24-debian-dev, 14.24-debian13-dev, 14.24-dev
sha256:b12f000394e82c076ed4300d614cec2f2706da6377df27dc90d1462340641082
Manifest digest:sha256:49ac8e4567bdd6e8e22b3a417d95807d9dedb7a847ab2c56d50aa47cf3b1e173
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:bbc34f943f84a02fc153c083f756121ad3fac49d2c40ba7733b40c7d4554ea2c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:1516cb8b4dde972401b2c03989a24d181d168b3621b509e230c4127e7abe5905 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:be6b6805af79e18563d9a49a836fe665ca67089d3070bfd1214873fbd01ad5d2 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:d9cfa004de7044368e3b5a3acc6755e57d15b3e8ab65d3fe2c6e9ed29153f92b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:1af7e18e5611bdee4bb8d8932fdd19fb4b2a9140679b0aba8d7e147cfb5b22ee |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:06013d3b796856cac5dfd6fc10af7d1d6e591218a242fdf802e9400eff7001f0 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:29a9fa47cc1d2bf941fd407873dc28b4f816bde979f2cfc1e9e3ff7d58968d29 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:fc4c4d58be4d870bc434203eb1f26863dea53a3f42d8b047a3428a5526163446 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:ca8671ec831ff5a422bc2daf0d0a08e2a7ab7867f2aa51d5720f0d8524401f4a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:64966c40201932e25c9c8d4db1ef6a39dbaaab60e1867f187a7373beb4f85e73 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:ea33038deb5222c12a26705dc42694eea196148304b844247491afa580f86970 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:36f7e766cec8c7a7099c7ba3b4126aa7dd1b9f7d367b56a08c54a52770fff358 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:b307d4ff021c7ed5a19e794f35d16c4d7c98d1c20a13b20ebdb9712f06b945b2 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:3c1c92d27798344d39408afae6933a81a4d99944ab48f7b3ef7f2cdf3998a8f6 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:55fbf21b8d8128ebf28d763a74c03a2e44ba83e81426b3a95d0798bf2355ba9e |