❇️ Pin our docker dependencies by hash (#468)

* check pinning in docker files * Pin our docker dependencies * Revert "check pinning in docker files" This reverts commit c05a500. * comments * typo * fix hashes
ossf · May 18, 2021 · 3b1c9b8 · 3b1c9b8
1 parent 90e1aeb
commit 3b1c9b8
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 
-FROM golang:1.16.4 as base
+FROM golang:1.16.4@sha256:6f0b0a314b158ff6caf8f12d7f6f3a966500ec6afb533e986eca7375e2f7560f AS base
 WORKDIR /src
 ENV CGO_ENABLED=0
 COPY go.* ./
@@ -25,6 +25,6 @@ ARG TARGETOS
 ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-scorecard
 
-FROM gcr.io/distroless/base:nonroot
+FROM gcr.io/distroless/base:nonroot@sha256:bc84925113289d139a9ef2f309f0dd7ac46ea7b786f172ba9084ffdb4cbd9490
 COPY --from=build /src/scorecard /
 ENTRYPOINT [ "/scorecard" ]
diff --git a/cron/Dockerfile b/cron/Dockerfile
@@ -14,7 +14,7 @@
 # limitations under the License.
 
 
-FROM golang:1.16.3 as base
+FROM golang:1.16.4@sha256:6f0b0a314b158ff6caf8f12d7f6f3a966500ec6afb533e986eca7375e2f7560f AS base
 WORKDIR /src
 ENV CGO_ENABLED=0
 COPY go.* ./
@@ -31,7 +31,7 @@ ARG TARGETOS
 ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-cron
 
-FROM gcr.io/google.com/cloudsdktool/cloud-sdk:slim 
+FROM gcr.io/google.com/cloudsdktool/cloud-sdk:slim@sha256:acb34ca33bc83255110d16a749b0da618a96fcc481348ecfe614b3edcabdeaa6
 COPY ./cron/projects.txt /cron/projects.txt
 COPY --from=build /src/scorecard /
 COPY --from=cron /src/cron/scorecardcron ./cron/cron

diff --git a/gitcache/Dockerfile b/gitcache/Dockerfile
@@ -14,7 +14,7 @@
 
 # syntax = docker/dockerfile:1-experimental
 
-FROM golang:1.16 as base
+FROM golang:1.16.4@sha256:6f0b0a314b158ff6caf8f12d7f6f3a966500ec6afb533e986eca7375e2f7560f AS base
 WORKDIR /src
 ENV CGO_ENABLED=0
 COPY go.* ./
@@ -26,6 +26,6 @@ ARG TARGETOS
 ARG TARGETARCH
 RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -a -tags netgo -ldflags '-w -extldflags "-static"' -o /out/gitblobcache .
 
-FROM gcr.io/distroless/base:nonroot
+FROM gcr.io/distroless/base:nonroot@sha256:bc84925113289d139a9ef2f309f0dd7ac46ea7b786f172ba9084ffdb4cbd9490
 COPY --from=build /out/gitblobcache /
 ENTRYPOINT [ "/gitblobcache" ]