dhi.io/postgres
PostgreSQL 14.x (fips)
14-debian-fips, 14-debian13-fips, 14-fips, 14.24-debian-fips, 14.24-debian13-fips, 14.24-fips
sha256:d2d35b279ec8178c1dae6890f645641c1083bc3f24df177bc1b1d0d9bed8c61e
Manifest digest:sha256:2eacebd7365a126996b39fbc6eede1cddc75a194258dc019486d65e2ca14f018
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:24f083db5be8a73577b20a95145b6e31903d47f18d73081ee726b7765d872917 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:b714580e86aa2f5c6117f9f77c6d15812e4ff82ca19e84a3426168de1677af59 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:7a4e50190394142865844d7927cd2a726bf08f7db34564c95e4e81f947773a4b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:3e1fab8c738b9aaac3d47ad7b58ef2c486e933995ed616c075e6a48701c009f6 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:c34a62d23fbcc8a66ff38f78c2ec029b1a5d1878d168e80e44e350dc3eb9b6b1 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:bca7e6ad87c740ad81a9d4b92461553ac385f6d61482ddc5262421bf3feef6f0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:0e459915ec3d5f5e92e5055bd35fe50bd03d062c9122dd02e168f1e06dbfae6b |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:552e10c007888bfa7b087fc5a63ff25422fc18c09d298ade3bd066411d961c1d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:f095df958cdf7763edfbbf27363d1b2d971510676e359ab0a8ca0b533b2565d1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:a2816f82c5bc10a2997764e922dc9e4495106c36aeebe6d6b0af2f31d05b099b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:cf9197199f1d17d9bebf410c9d192d9187eafe607fc6d108b9a79777d9d2e534 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:01011bfcb95225f9a66ecb5ee5c0460049b16a828df5e85392da86364ecbb261 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:977f07cd6862029133a7c4e73d0d07b87751aab9905b8aafad9da110e95e6589 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:dce54e56e01bfef6d731a8d3bda47139810e226cdf5ec945a6c125bdea9e69b6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:20e2f7d2ace86f7408776f2e933139018cf84c66f5c9490de83bb43fd200eb1c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:85dc2aa411b33eebe58fb7fbf1bd3f5a585e1daf25062936980e842b99de497c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:b2c2e3e00f1480ffa37829c985945703f738b7927927395b57bfdd3902efd54c |