dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine3.23-fips-dev, 14.17-alpine3.23-fips-dev
sha256:c5c3946a8d9d3f16900f2d1e95e91c98d37d997144ed1e0ce49ff893ced3f0e0
Manifest digest:sha256:ecc62010aa87ef1e8f45fe49feea71ba649a29fb3dc23b5fa1159539a62bcc20
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:514f8d7f944483c353a220b24e81d7f3edcf8408caa609aac819298f510c1cd5 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:f4eb1cc3103830f286dba2be5d66dc7f38724c5d7166dbcd7942876dcd1c2d79 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:e5ba9107db0668658ad7f998584a3ad85025237bd40fc962fb4be359dec88de4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:c0dcece2d7a79b339989f8e69fbac9f8ecadf1aea614a54c1e62dcc402b5751f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:e149604e077918cfd946831804c95a70fb0ea41ce23a74738ef6620acc7cda55 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:2faa72be89a48140bfb262b62c6530a35ce6d3ee3f093e23d06719dc23e5c9d0 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:3255ea098d9c5d667d0b502931093d211ecc174e56e098171c6597fb6ce8232a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:4a2c34c6830d1be3367f2358b12dc21e3964f4db92cf13a644ecd4f4750545b0 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:3e36424c75665827befcd76045fdf5b18f54410876521b642f630527ed4a105e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:a28d2d29003df604045aa930614eed1fc74696dae0c09f1c846181877c52103c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:675fe1368fbb4491dffa25e8b1278adaeb3767aef3b8c51389ae5b72804572df |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:20a6db60f40da68b91b4dbdf83575ee70695ab7a6d1fbf8eb2bb02c234cc802c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:4ff1716c5af85fe3bc1fc83f432500a7db8baa6447368c9232ac7258898dfaab |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:fba6d6baad2c29aa4cb63f0f6f0402f8bbac36a8c3151ee2bb6ed55d14f27be4 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:966fd25143b34aefe4d68abcc8b9b73aaad7d0985a4995c5e704b32a7bc49e75 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:3d7651d6994be89d2d80af3ef357d322e749d169077a72c5393cbc7a903eec02 |