dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine3.23-fips-dev, 14.17-alpine3.23-fips-dev
sha256:a9129df4ec4fc51fe0ad6f13fed519bcedeb9c7f3447c7ec0051270633f9eaad
Manifest digest:sha256:21643157ec290ccf76d89bc5fde094746dc9382ed8f29b04c298a92f61986159
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:1979dac60c1a6895d3dd5c710abcea7e90bd353d36835ff0a40ac70302afc88a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:4f77d10e9cabe07d08f14b66ec794bd0fb674896bf5b59125124c8316e6a9033 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:377c7b957a2644b3961e23834254f1e00b5929147980dda3940fa0a24d746b10 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:976bcaf63c78c4bbfc21f3f37c03bf92a3e22b34e7e0fa62328014d87352e5d3 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:a72f05c11e1df92a6e243778b90105a92410e53df563725dd71adb0bd01987a5 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:4fafb254b3b9d0f3245463d6f1f5dd3adfcfaee9933dbe26a6eaddd2f02157f8 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:bf6f0c53bdaebff99cfd7f8a3c49c2810060f909b39852b938fdefe511ad72bf |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:653d44ff3944ff9a3b3642316fa37bbe1ae173072d0f9a07adcef06158432620 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:031908f133afb668f711a1c2cff7264da7e35bdc74cba526e4eb3b33d515260b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:845bd73132a064e8c74226a79e6bcd7d82d7cc6bf28c9c24c71824a7dfa253a8 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:07639040bc69198aa6831740f08d68d2eb2a2c9b35f1cc44e27145fd07b5097e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:4ae103df01ae0a8c628b660f8d6a8630d8931680b74fbc797dcd41860ee54aaa |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:c7ee102b213e952d9fdc113fd4cc86d6074cb69acddfe37e9e46d4efca9af993 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:c26b739fad4a3bbd9e5363e620909e84b6cfdc9c1c8dbd18ba6d6a3b66bc70d8 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:5ab5b17c7b0c1608590b88600091d6685dcc2ea84e8b1e1389d8a649343906b7 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:101cc5a3123f9cd23dec55bfab436ad6fd09c7fffded8025b7afb63ad868c2be |