dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine3.23-fips-dev, 14.17-alpine3.23-fips-dev
sha256:7f093c99431e7a5e8fa6f269ed42280b56e3b6a35c28cc5b0a53c3f0f73e8c04
Manifest digest:sha256:cfaf5cd349c414cf6df5b178ed6fba9be819889fe5d1493a5218594e3a631805
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:e11cc41980f60807eabe127e74e8410ea5c93d16290287fa108c40fc5b332433 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:9dfc14a8039f7f872de5932daaee08a167c4df63edd04646709e97ae3eab3943 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:f6203cf4f090cfff8460aa22df55f7afe2044e5fbf5e0a009301c479fec9b19d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:ce31035e3fda3652697542570a87cb8e1855ed38bdf790bf47bb4f56df5a000b |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:7063dc79afd435366e4a44af26eb838e0fedd718b6bee963f0b2a3f7c5ea2328 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:f17fe350da40cdea71bf1891573b41e3ed4c2d136f630676196885933c6f9706 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:b7cf6b96f647ab9f50821bc9cdfe8a335388ab27bf4cca1fc7ba2b780e30bbb0 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:167f230dd9bb6bc50d696c408d41c0dc6881f9a3f044e389e89023388e5d035a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:92760cd935d9eb48183cc4f33b23a7ec76543c0ddc07220efff17fa1d7ac1f82 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:92809e5c61018a0b8d9640509736ab8fe8cc78cc3b4d0d1f62bd113972eebc3b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:f6d81af650faa212e06dfcbdb9a4e1bd19559917201664df82839b4bd412f17d |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:276fd5cfab55aa2872e4c5adf22f46846c6e92a6c63ef9f9498238aad40207b2 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:7a4d2647fd16beb0b9904ee643df3d22b1a6c9438868ea73bcec7cc395ff55d1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:d8801447d64af4b5cc7cc1dc0826e97bcf9b471267d5a92904a7104b74fe9344 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:9b3286e32c2c76490fb6fedcbfb920db10d5174c0e9618b697a9977bab63225b |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:c8aaf1e1c3ae416d8375542bb8cac81b31707b3f70cf1e7f9fcafc34ec4b4aa3 |