dhi.io/postgres
PostgreSQL 14.x (dev)
14-debian-dev, 14-debian13-dev, 14-dev, 14.24-debian-dev, 14.24-debian13-dev, 14.24-dev
sha256:d1bd3bba7a277a71177d2b58169458360c76f430373646a7763a7ac7e9a6b636
Manifest digest:sha256:eba310a024ebd6ef610b08ee2f10c4fe3d79ce4f630b836f1b92f3ecd7f7e982
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:369f7677b7bb53621d619504026c53e1d25d2b3924f40c369f0568779480336a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:c7983ba0944d3a893f00a08c5583937eadc7688d9c2cb938f5cdf3e1d8242d73 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:3d04cd45c5a9126c896593b6caf5a0d09bd7d685b9f27ce5acd803f4d5453d9f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:8723c378706fc1d3a055947968365b884b17454581f24e88675c1c1e740b7f73 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:f76a3b8ad28b9864278f2ba8e3036b32ef8f12a42749f299c4e2f183044e730e |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:07e18e2df7f9c3ea68004c5fc04c3cb3040f39861d58a54f165593e5f167eb2e |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:c89a1ff2f7902ee88e92a6a830ef29e9fae939c498a934e5ec959929ab197e88 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:7f676b5913ed0af7a7975ab3ad02819ed7275e2bce7c810792ef765de8d8803d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:06c1de32deebf449fadb66d4192030458d3b4913940b410ddfe0f7c2cb541a74 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:fbf6586aa7c227c194691728c1df6799df652480dab673e0df24e001474123e9 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:fe3bc65a737e57ca13b5e4787b4dd00d2588a077c255520d52c9e6c9b948cd69 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:2d6a6145321dff40ed3045f602456fd01168d3cb5abdc135c8071c1165c49f93 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:d9030b56e54190955bfdd86af07bec691547918d0ff42ebef2c42d717c5675c3 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:5c61c2f786624c1daf510965b0af32b5f94b565072e6e571cc2567ce53ae22b4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:a964a43afe06d0e066ad31af6f0b8c5cccac196298f81be6b466b0aa2cb028b8 |