dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine-fips-dev, 14-alpine3.24-fips-dev, 14.17-alpine-fips-dev, 14.17-alpine3.24-fips-dev
sha256:ed6e618aedb793e4fc7cfa301d313eacf18cd3c2177e2be20a98f34817dd0782
Manifest digest:sha256:148865bf52f19f2ce553b21532105658725b3ff2895a4a272ce5e9f00c521e07
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:e00328578b7a03f6ab55efd828140c294b94f6b88577f8777ceb66325318067b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:17115ec05cc215e8359173664de76c016ac548243a7d94c6241292451cc488e8 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:230d209066b08807c6f5452033632387dcbd3c822f90401ecd1cb092e4058c7d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:a8ecf5bdcc5572d31cd11772a1452d695c9a41efaf469ddbc3833b9380e1ecc3 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:51d01285c35accf77c4b7a097c423e898f3dc1a12c0dfc8eb7bd5daadff26606 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:5792abf98da622e276e7bbade560c5f159c43f35776f8adb0fcd248e2b864226 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:3c8ed3cb85df43629309dae6fbb627afcd00f000859c2d1ad011892f879d5044 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:aab15febad8058e45b6859a4acbf324ba981bb40068daf5fb91c44462908d23a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:15979ab2a777bd8ed97a6a7ff77608f8fbedb4057c697fa28defa6e2e172e265 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:42cb0ef0ce6fe5b84de1fc1234d0a211d65b055d1db4466329cf4a089b36b607 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:e4b53086328f0a7e6b2d72eab5c8b62700b0eb03c84633e5d42998b3e68a522b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:948ef806f8339756b03864cbdd935426897cf149f6f9dc2ded50ced9094ce718 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:9e2ca398784a567911b0e28ea2eb121e4c1f17988c4b003da29c40ef7611c81d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:daa7fa4f88b683b97377cf77dca9fc65736505ebbf5a2f3224ca8bd0a26bf343 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:16426a27a0703dc0c37c59bb5b224ee2f81552c9bbb14a076d1419f5b002f45c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:ab0478f86b7fce25bdc744809615d94ae07034ea88b12b63267a8d1c7b3fda45 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:3a55f10ffe676b9f299af7f4d0062d1cb7189c3cde975f1c022f1c761d50ccd4 |