dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine3.23-fips-dev, 14.17-alpine3.23-fips-dev
sha256:f30b57d1f08c3cf148a5e77a8b7c338c2b2d00a0ba9b4cc9ec05b2bd4abed975
Manifest digest:sha256:a424ba8a0a80d91b3fc8c8f681c51dc48bbcddfef0a69763307878eea66a69b4
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:72e3fced2e4f07261776a71e176353d36f4bd30be9ce183b25103e8527499a3e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:19a6e853203af80210a06d6bdad0cc32bc1b7ab930a45ef05f2baccc76fa0307 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:804ce0de4651d1f2f3576946873a0f57d384d4570186a53b74ac86c0addda3e7 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:ceb334d0b3e8f975fded363e78b2f3924e01975bc7bb96c3a0457f4a4741bfa5 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:3e7a6a3dd0b54facdf480dedd5b6562c49641436b15d502760e25bee45aa763d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:d420ecce935a9d4a72902ee5bd09ae637be32155fdffc028c04600026e2a6962 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:8accbefbfaa2f9f404805df32b583ee775e8ef073898fef6a990574c57d9b585 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:136bd7abcc78fc5012deb1db356853a185a32edd8488691fed8d26b4c6bba153 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:cc74d0e9589bd021405704f244bc4fb79b3919b31bc196f00491b37d52d29627 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:688e9fb0d42670a0346fdc4cb315ce6b9a8ef26cc444e00694d653322e6b28a7 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:0f881ffed869f7cc880f5e710474fad11eb858194b9f45995c4991b1ffcbff0a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:9bbd9714bb61c11cb95dce0ae4f5ec82c723dd8b5e0bd2f2c62e2bdfdd355a10 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:bed13e14760f7e9fb6c9af08f072104730bfd7cf8250cd7ee58666d61424ac13 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:d1f4643ce1f6d4e6e94454e9df6172ffdd14bf52801ab385a483fb5aa9e5185e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:9792f0ea21e9f2ac1c418c7926f35c424cbdb617cb5c275dfe40675c7ee12ed4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:0b607d298af91344fbda7d8056ed77095fca6034e5e2ace11fc3b3e9b592140a |