dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-debian-fips-dev, 14-debian13-fips-dev, 14-fips-dev, 14.24-debian-fips-dev, 14.24-debian13-fips-dev, 14.24-fips-dev
sha256:d3622fe02d760da66166fec6d5e2d6111ae0e48048eecb39aad7d446f6b04677
Manifest digest:sha256:b35c2285c32824ed6dc1b7b6a704506b07d9b4a328bad7b11caf75249fe7ac1b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:9af9d95e3affd59c4840048cc341424500b89bb16e35add288fb7be662976300 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:864bed9ed573f13de848039aa3cc8e9c19ed023eb991ee852a301f3181a468d2 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:e62d263a3d836f28040f07255e8a7ec19e3246379ca81c0ffeb072c564f9cf5a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:87844b5a8a389420aa5d07fd044f825ba28d7789214684f8eace6649f299e197 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:7a8eecd694023a977fdc202bacd95edf05a67c84f73dd0984370a63957fe5ed5 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:beab2bfa7fe6b63703f8fc8d70026330dbda22ce6a9ab4e608f549f1b9ca04d6 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:2c6271d5f80351de398c05d1d78c06f436a7fc7055c28f9322ddf8417d348f03 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:f42e73f3df6869b6c46e795834f9c3f553b3e08427577055d0274a3fe396c4c1 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:8b46f8b3acf9a1f8e710417dfbd8ab0ce98818aebb07be119e1382ed349ed0d5 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:f312e5b912c1853908fa6eedbbc206b1445fade6d1e1411b459f08e580f1eead |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:5e83e2b0fea35dfae7148e64555d3f3ccff3c33ec8c3db29d62a52c4782d2aa2 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:90fb3f0f8e0df6ef393789c54a51e5f74d25c47e61c4f96876d55a9dca147279 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:fe5f8f0cff1eec7c03d22341446b293a3ca3c9a9c1d5c85a0d1046181ca63ea0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:e0bfb26bfc56d2f2d1daf351fbd5961f940cc8a8d7667ee122d2f6063376b480 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:1004201f8e8358b94dce8dcc1dedfe883046347f456486255ae3541f4d4b8daf |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:13022e999cd9b98b172b0b44fda7825b90bc880e90fdb94090354979bdb3b138 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:0f94e1ce09186a34a7b9594d9e45971ebb8eabe62714ee9fcc7ed21f531760c2 |