timothyswan/defectdojo-postgres repository overview

A bit-for-bit mirror of registry.access.redhat.com/hi/postgresql:18.3⁠. We don't rebuild this image — Red Hat does, against their Hummingbird (RHHI) base, and we host their bits in this registry so the DefectDojo Quadlet stack can pull a known image even when registry.access.redhat.com isn't reachable (BLK, disconnected production).

⁠Two cosign signatures

This image carries two cosign signatures stacked on the same manifest digest:

1. Red Hat's keyless signature (preserved by skopeo copy --all from the upstream :.sig sidecar tag). Sigstore Fulcio-issued cert bound to Red Hat's OIDC identity. Verify keyless:

   cosign verify \
     --certificate-identity-regexp '<red-hat identity>' \
     --certificate-oidc-issuer-regexp '<red-hat issuer>' \
     <this-image-ref>
   

   Copy
2. Our internal cosign signature, added by the mirror CI job using cii-tooling/keys/internal-ci.pub's private half. Same key that signs every other image we host. Verify with:

   cosign verify --key cii-tooling/keys/internal-ci.pub <this-image-ref>
   

   Copy

Both signatures are valid — pick whichever trust chain matters for the verifier. The internal signature gives consumers a uniform cosign verify --key invocation across every image we publish; Red Hat's keyless signature lets anyone trace the chain back to the original upstream build.

⁠Usage

Pulled by defectdojo-postgres.container in the DefectDojo Quadlet stack. Direct invocation isn't typical; see defectdojo/quadlet/defectdojo-postgres.container.example for the canonical runtime configuration.

⁠Supply chain

• Upstream: registry.access.redhat.com/hi/postgresql:18.3
• Mirror tag: <this-registry>/defectdojo-postgres:18.3-rhhi
• Mirrored via: skopeo copy --all (preserves Red Hat's :.sig + :.att sidecars).
• Added by us: cosign key-only signature, CycloneDX SBOM attestation, SLSA v0.2 provenance attestation. All three use the same internal cosign key.
• SBOM scope: layer contents of the multi-arch index pulled at mirror time.
• Provenance: records the mirror operation — subject is this mirror's digest, material[0] points at the upstream manifest digest.