dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-debian-fips-dev, 14-debian13-fips-dev, 14-fips-dev, 14.24-debian-fips-dev, 14.24-debian13-fips-dev, 14.24-fips-dev
sha256:dfa9cd19f7937913c26c67eeddf994282c4ea0a59f4d3ff4387dbd4d033f72a8
Manifest digest:sha256:6fd70a8c07f0801f1fe0f82efcdaf403bde76e8a2260f754845eda0400f7d6aa
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:382eb89a0bae23a25d991fa56f8453265df9f97af31215a3b43ab815b346142c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:0d610ce03c48cc58aae098bbebae296d08a196c6f5356adbc83898f6c34f35f2 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:5957bc4a7464eda3be1612bbc8577e6bb97fc6c866fc5592e1936876b17f1a1a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:40e910dd19f26db1ad3f9ce8538f489c2bfab7f5c7bb8c658a9d504c5e720b45 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:a8108b39ba966659be5aa49f7bdbd3f5dbf71466576b748cf89c2bde8d94111e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:437c3c3fedd0da5086cc9385ee6fd88a3168abda0e9100919463c4f2f0f2be02 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:2b0f579c6642e349bf9d3bf1fdc6b05ab21140987544d5eefa3cc88d74ea8b77 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:ce66d502643efe54de7afe90b7151054c78f37ea752c8a189974d54d8a1f0a83 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:e0faebbff6468a5e0fa07ce7f340f2f0e18440f0f3cccced3088c19d37b10e6a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:d395e05540c218470121497c7e0bf3c8f31e5fa07b39382929a66f60ff80051d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:c51b3dd744c68ded8a72c6550ad9ef271f2527dda235ed545164228d67c43bf1 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:042efe363fbf27ef54162e4c0bdc9ae4118767215c253b566dd0da058cb86f8c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:a5d52522ad994f53da44f8e32e607073db92775f05a3ce8a9de1103ade1035d6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:8b60b3fb39539cfa9fdada5e465bd4b823c5321e2644e65d737953a38a0a4549 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:e88ca4cb55488e59f3e07514fafff8f19482ce5654dfde20678e115cf3622849 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:1db60d8a9e172d83e752979389edc3c384039461a2c1cee40b1ae37c3d1b0759 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:50023e0da81a33e22e7a5d373255e19382b949a0af9cfd72ec5cfde5e47c4bf8 |