dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-debian-fips-dev, 14-debian13-fips-dev, 14-fips-dev, 14.24-debian-fips-dev, 14.24-debian13-fips-dev, 14.24-fips-dev
sha256:352f66767d1c51e6ec3801edab96cfccb96be71622ef6a530a25ac9a68e5e23a
Manifest digest:sha256:091551bda3c90817eb6765ea3686ef1d2e748ed759e7f96a840180f6c5400811
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:d1f47a00ea6e25583a1d83b354e9186ce54f0e0821ba53b254f84c7475017705 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:28a776f5971c007a31e18ed3b3084c4ad562b562debe7cddedb683b09dec7e83 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:fdf4e4521e24beea627d25bc3738a5c405633a8f0f45511264cc21c59bd5359b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:2abc3e53c188ee38d074e9a60af152edad19be3b2f9e76d2bfafdba6bc70c24f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:863ab2f23150a1eafc3aa6792ea407535046e996adaef1fcaeb9bef9b80c366b |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:21107082423bcc57930ef814357d34bdfdbcf84d1fa9b988effebec1cfdbacd8 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:9984995fd2f5d71c04ded03bdccfada7889b6cc28bd830965e8b89951aa2aaf8 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:ab28b0a48e0dfa0e54d085dfa710d59d564db24abeebfff2383be4eac6f6b4d6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:e157c0024f81898edc630df4464296e10d12814ccf3613d190fb7e45148adea1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:6d3bfd9e689a5fc0828cb96122171ccc8481ca54fb6df8b7d528e94513c053d7 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:2255f359560bc58ce58db5e0bf012aa387bc32bbc88695f417915f8bbdceb6af |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:a8ae55c09580861ea25db1b58f4769502aa6dd6930d3e62f1b8edcda95cd2423 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:81ef74922f5a692393bde255ab94ed716653e30029b8a2028dc0d9010be53418 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:a766105fefe173c8b86af54808faee732cbea6fef83b447a60225eb4b5b85053 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:e6ea7aeafd93d6216be5160f8bce5c6119a3001095c695aed5cad1bb6f67cb8e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:aa1cd64bc444f44c7e74b1d06aba1730ef2869db2286b432e72052f22bde4fa0 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:cabacc96d7256294adb4010253753f2bc7d0de800615258a931beadd2f087c11 |