dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine3.23-fips-dev, 14.17-alpine3.23-fips-dev
sha256:471adbb6ead40cd8557bc26d2a29f7da74c789084708fe6f823571e7d47fb340
Manifest digest:sha256:e2f9326fef2b05f8094fd623f0b3bf6fcb0d962ba36821dcfa9e96de5e7cbbc8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:1ae65c2124202444ea44dbd4c360c24e9ae707597b2c60654a3ef5d6b9ba049c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:defe612b419a9170df5a78a6e2b8d1c4fd7b1bb6d70c031bfef274a981ffcdc3 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:ff182b8f547c462e663f7b907556fa78857ad0b01ba5955bba52be040c06734e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:3a8de8564e63c5be238378fab03dde88b8309010a546fac28371b542dd3d6bc6 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:a287640d531894ce18a9b206cfc6ec5e21cc970653a444b8f654076b9503356e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:6e3e36ad380ea6fe34ce5b7016501f305d6b3c6d9ebb19049cc9b9b5fe394985 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:6bc9457a6febd705b1be48cebcaf52f9bf5bb40cf1f7b65d16e3d7991f7bcc75 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:72053ac90b874f57c9de4babf7b341d89e9d95eb313dbfa0ba2e897bdb283d23 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:e9f4ffcc3f2acf1d1917215b73bbdfda4fab5fa9c6d2b83785e49e0aee73302b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:282f75a2c99821c2c232ef63d01e17f47051e007ea9f02f7c3e3531c35dce016 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:cb5cdc12b5aa0b12b65c9b711dc7a31007417f2b801204927999d89384c1a685 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:87541a1558cb5bbdbefe7042edf8e406aaab8559be8c99f8e0413b2aad860ba7 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:8d4b67ffb596f3ad3caa418d7349cfcd9a8c0fb406cedbfcfca13ec969977cc1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:76a92c59b6fffff8c71bb3c80814108a5b8dbfbfce5a023ed2d0a59a479eed6e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:b1f5f049ffd60e3d0bd71e9c5999dde7118a9406c659206becad804e1871b592 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:46826ce4b6a7021ddb9ca8892e3fe88147e03c36ebe40c57caaaf4c0a0ff02be |