dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-debian-fips-dev, 14-debian13-fips-dev, 14-fips-dev, 14.24-debian-fips-dev, 14.24-debian13-fips-dev, 14.24-fips-dev
sha256:c641ba42dd51d310d1c91d4fba694457bb5cfc8d212dfe255f47ba8c21daef65
Manifest digest:sha256:1fa512c2f3cd574c544b4e3af87458d3716e44553eb8a78f9e0f445f0d3d2bfa
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:b790c3fc7964e2082157105335404f2855126b8168bfb444e5014b003af40575 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:4cbde689af4324d745674c88b51c31dcd8d1f2d164e7aa3c5e60df98d2041aee |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:665cfc63332c83d46186ec1d9486116f77d1dcc719e5a261bcb42da57fe4ece4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:201a14356dd6fad774e7ad4af60044018ce414c4f6af0aa8c35e5dd966ed0329 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:bd3869f69847edd1daf55e91f4603271f09ac246835e1082f57e553e9ab07b81 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:6e5640c5c4016d5eb4981e0b51c1a73e6a20150ffff2927b6c7825e9ff963dcd |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:80c9c960ea3b04274fcdc642b881faee5e3214f1294089846d3c96ddb5a1c6da |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:eb4958ad2303b27a8f906d60cb5f78ffa0dbed41f85648ed660ff4c138b46749 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:bc765d7379fd706709d58af5540d9598ad0b884808bc41de638188cb8d36c1c4 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:568dcfa21dd11b6d4ddf65c93955e54bec9d4833ca197207838fcfaca2f00ae3 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:24e0adc598cd4749467c3144f35defd99c4e9c896fbb8162c55a12befe82c7e9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:57b8efcd6a791fcd712f77011480a4c6c05d72965ba5d6fc2940b8cc799f9ad3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:d2fffc8762d0b3b0503a2fe2ac48b0ea140fa7ff5dd7451911d760a22b73ebde |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:5b9d7f20087722f24f40d4c9bcfa74dfe80d041b5a9a13a0d3604139ecd01e6f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:6ab4643df304acd1f6ebc948db931e2a5c7b85374f6013b6e8485c782e5dc10d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:00e7827ee0f7132ceb75036bc2fd8df75a067c41fd7d500ed2a04f0f61fabb8f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:65bdd1ca6de31d8448622921d42eea025199501fc78adc77d9acdedc2a762999 |