dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine-fips-dev, 14-alpine3.24-fips-dev, 14.17-alpine-fips-dev, 14.17-alpine3.24-fips-dev
sha256:9b53f64f8854b0216a3c3b2fbb42c6739eab651046bcb1ede73735940aa870b5
Manifest digest:sha256:c3d980f5dc6ad7e0253eef88865c3244a6552c4147711f3e56146b41e8ca746f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:5877f0b2f2ba6941b638776156987d33abfddc19b9b1279e3b0efe527f26f9d2 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:94b65f8e152b76bd18105019accba868b13bd2c4a28f9927ac08532f23bc548c |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:5babec7d9ea8b0e1c3a3cdae1598b14fc26b87294404310c74db0271d79f7038 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:042e90fe2e180023be559c2e4629c4063f973788735a0dea4a278381d00250f6 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:77a0d86abe6d86eec8545d2efe224d38438a26048ab74b30b6bae21a8fb1df24 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:85087ecc39607c3a85e68ac4d837f8e1f022183e02466efae0cd4705ca02bd49 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:cefda9ed2c39ccf80564f9417dfa482f14e00ae65f5c359cdfd93c3cb165c608 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:60a8c9445ebefdcc6d6b8310ce8de205c50b927bc9d6c29746fc76976fa7fecf |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:c96befef6c1788e76ff8194423bbaffbadb86b463d1dfeb874f40ae9bd8bc547 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:dec2b37823954c5a7836bcb2ef9750a3a5fa6a2d5e91c4cae4010861f623d778 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:fa100fa570b7645a896cac7e54f2448b97570eeee69e8b60716007f7c5dae1ad |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:7d4f6b349f097bf91fd5d90d0ec0d0aba273dfe0dda27467a669e543eda74451 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:d3e393301709939d657fb97a5661828872f406154cfa5b5bb571dd8c815120b6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:fbad0d99ecc5f9e2023fcc574c65036e2c57476f61e4fd8f90fe8e695bde48a5 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:d624f69fcbc49f71828e7685760a0b69009d4aa82643b3244cdc2d9b11cd3b41 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:902a9586f4719cc099a46c59cb9de38fa96334c1b53ce0fb502462cbe3011e45 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:038ab4dc67609285e1e92dc9106556c7b5ed26023ebb3c758254a477ac5179fd |