dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-debian-fips-dev, 14-debian13-fips-dev, 14-fips-dev, 14.24-debian-fips-dev, 14.24-debian13-fips-dev, 14.24-fips-dev
sha256:2b6d2542eef138cadddd6c58254648c7e46ed75ea81e583c4682ef6a9871bd64
Manifest digest:sha256:67ce88d9fb7ea665c476fd2d5fceb146d52f15a420c9f3c32cd4f3590e88ad1b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:bc11d13feeab8b8d4c491504005143dbfb9762f125737b405c9c5923ea0296ac |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:74479cf0ee3963afb487eda311e2190946b2b923acbbafb218d8270de76fbeda |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:ec25da8f3ce132f1e3bb868c1f2b4fd6cb2121fd0c6c0a0558e7ed22634f0d75 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:6887a101b7038c50c2698640ff976605235598a367f9c6f3db75595a765c33d3 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:8e24099413adfa1049ed355ba646d66c85fd1733799413f212fba62a55490557 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:87dd80b28d835c6640e274719b54f9acd678a564e0b8b1303da3cdae3eba4a04 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:fee3aa2bcc0d0bb41b7a03709001c776c5fadd0c2760218cb33534f44fa96e9e |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:bd8c8a10b8b6c6321de93db8161c0b205d702f5027502acacca49a62be1f51e5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:e1fae73adc9c0d5772c8d1099239669dc462a6965c9e18d579d1cb7a4fd34a5c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:4054bb2b49438ae82607a16322f337a4dfd63b913b1dfcefaf49fd3c54a10cda |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:31cd076c3b531815711517f92a009ed3c06c6430e5c5e55671e61bb716dbdefb |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:857be6c82b62f228922f123cb9dcb7ddeab1685228f0d831c2b20e4088c44aeb |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:bafa910ff03596aea5a575e0e0712c88a97b64e81088f651e9cb6e6fd06e90a1 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:b6ea2e9dc4b438adafd6d0b959d1ca6be1d25fe06f0a4b98daf4dd43cbd6e4f9 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:10f46329cf776347b2446b5ef2b18a7d07b23c1f6c35ece473bb1248691ec2e4 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:0bb1577c86104bd01d0b6a438f995b03db39e33037b36dc987a34bcd9437b99f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:935eef882a98b2d32018682d661f2da8d33ad341981c45ad024283db1ba04a2f |