dhi.io/postgres
PostgreSQL 14.x (fips)
14-debian-fips, 14-debian13-fips, 14-fips, 14.24-debian-fips, 14.24-debian13-fips, 14.24-fips
sha256:0574e9038ff3af0397aa989dbaaff9c4ca1607105caca5989b1ae54cb64aa58b
Manifest digest:sha256:5f4b8b0b5ea00e6900838015652c9ef776926af8e2d8e435b9d22e27dd53a92d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:d4e83dfc31c64c160ea6ee36db998aff06bdb6519b7ab5a5983a221b7473fffd |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:cc6c4111cf236d6392dfc18d3ad70a0699a40da0cab40fc15a3a9012cb1ef545 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:ce45d54accea37d2d5ae5eb84f46e76418ed7c413d65ba1c1dc293d3a27b6866 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:9d678bba35340c45b028f539aac1a846c56e01af1546e948bcdb0243b411b8a5 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:a2fce6d02a3f5b9d813bfde152d89eb07461f336bc6bcfcd2c2f2accc63f47d9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:91d9d2957b89bb001efe8fc568ba89e6126a8d354b4c31e1fa79e8f8df8f13f4 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:396f62b7ac17a2aa5bf081a52a96c8312874a525e5b28463a84a7433d665ba4b |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:f088df2e2bc85eaedba90a296f023a42204c0f20e2345657759efb1431858388 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:d3fe412df588bf01b2fe208f476905bd375e27ce005b314170e1fa60cb712ae4 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:54cef1c962faf7415878960c5af3cbc43b038914c7c59a60daedcef7bc460693 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:b3f1c457904fd18421a9cad803415c6e53916a9264f80e88b8bbe6807c695824 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:8298db47b622d7c413f6fef75052c61d98040f2ccca945b16096cd007f5de614 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:19889f8513e3600f35c344a7c2c009272252a2a31186bd59812d25f7928fd8b9 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:6cfa00130f8e8d826257c34f4fe72ce0c2fdeec7b7f96cc17245d47d298421ef |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:fd243b6a2b6fe6f4130950e5998e61bb123da25d28a294a7160933b22586feaf |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:6384adc9a7a71308e66c5c9317b013faf7bb0220c0bd634912eed601e954b20e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:d45db2d08cec6a4d99275022e7798978f5ce4f74ca701bcd4160a77ecf9c9382 |