dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine3.23-fips-dev, 14.17-alpine3.23-fips-dev
sha256:fa3eb6e4a1830a9dcd2d3009d9c909a503301ee7a8f8cb85974d3e4d22afa600
Manifest digest:sha256:d025b707221bda78c51043a83cc522839d5ff4dd7d2b09dacbaf717017f4eda7
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine3.23-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine3.23-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:f27da407ad068eb82befb7a7e7bdee1413d4d1a1fb48dea684d8290b3da8b4a1 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:f25ce7516b8a3753609c834ce819b2fef9a92e0dd60ee8a92304c9482be39260 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:4f4e9b0f0257d366b3c607d7b4bc13459e0efd07d4465c978d41250845783a13 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:92bb8423750cdbe90d4fce1027147672b688e615fd501174f7f69d3d5900cfa2 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:1741ceb9a81cc9882c53fee2397105d967febdf98c6b2039416efeb0d27cd3b2 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:5279c089408f05caad0a9bdb2985bb1c02ddc64b78cd81549ace798c3b5f93d8 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:78e3113b3b4356a85672cb23e5c77ea143249f7f8c421724806be1e47a048cf5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:4495812f0252151e7a6759fd64472d17deda341c4da73b351cda4eb5c5603418 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:4c929bf37162c41416a13edf3ffa954d099da02a282a5f9f9989f38298a1ab05 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:689df71e46d695dd383e85420962647d6fdc76b4ddf916259990f0431166021f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:fa4969603f4263a242f98ca60c9b2bc010e83b23493164c7ba40075dc5d9c525 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:52459452a56e6ac85a32813cbe8047048448bbc9fe5c60e4e4587952d1d31e32 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:b6168280d384002072ba481c0edde349ddb3f7a4b10f49fa999cf1c54a2d2022 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:0a5976dc2c4d0723455422fcc4515e1697da4405a5f99f40931afc474f523696 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:328bd04f6be47cbef9d1d0a327a8b1488965e690fea13c417b4a8c3c73ed7121 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:d4bd711edb1d51f9da21b373467cb4089d000ebad75791a1fd845775f29ce4c3 |