From 1f50c9d46c145d38dc0c5c281bee5f52bc14a690 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Thu, 23 Jul 2026 17:49:41 +0200 Subject: [PATCH] build(test-infra): pin container base images and package downloads by hash Resolves the two open Pinned-Dependencies code-scanning alerts (and one sibling the scanner had not flagged yet): - ubuntu:noble in Dockerfile and Dockerfile.lint is pinned to its multi-arch manifest-list digest (verified against the registry and the scanner's remediation digest, which match). - mstorsjo/llvm-mingw drops the floating :latest and pins the current digest the same way. - The MSYS2 zlib sysroot package in Dockerfile.mingw is verified against a pinned sha256 before extraction instead of piping the download straight into tar. Dockerfile.alpine was already pinned; both rebuilt images (test, lint) verified building with the new digests. Signed-off-by: Martin Vogel --- test-infrastructure/Dockerfile | 4 +++- test-infrastructure/Dockerfile.lint | 4 +++- test-infrastructure/Dockerfile.mingw | 15 ++++++++++++--- 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/test-infrastructure/Dockerfile b/test-infrastructure/Dockerfile index 59e11a7da..65804197f 100644 --- a/test-infrastructure/Dockerfile +++ b/test-infrastructure/Dockerfile @@ -6,7 +6,9 @@ # Build: docker build -t cbm-test test-infrastructure/ # Run: docker run --rm -v $(pwd):/src cbm-test -FROM ubuntu:noble +# Pinned by digest (supply-chain: no floating tags) — multi-arch manifest-list +# digest of ubuntu:noble as of 2026-07-23; bump deliberately, never to a tag. +FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 # Minimal: gcc + zlib only. sqlite3 is vendored (compiled from source with ASan). # curl + zsh mirror the GitHub runner images: the self-update tests shell out diff --git a/test-infrastructure/Dockerfile.lint b/test-infrastructure/Dockerfile.lint index 58c26e4cd..a2ca13211 100644 --- a/test-infrastructure/Dockerfile.lint +++ b/test-infrastructure/Dockerfile.lint @@ -5,7 +5,9 @@ # Build: docker build -t cbm-lint -f test-infrastructure/Dockerfile.lint test-infrastructure/ # Run: docker run --rm -v $(pwd):/src cbm-lint -FROM ubuntu:noble +# Pinned by digest (supply-chain: no floating tags) — multi-arch manifest-list +# digest of ubuntu:noble as of 2026-07-23; bump deliberately, never to a tag. +FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 RUN apt-get update && apt-get install -y --no-install-recommends \ gcc g++ make cmake \ diff --git a/test-infrastructure/Dockerfile.mingw b/test-infrastructure/Dockerfile.mingw index d496a7049..9d97fe089 100644 --- a/test-infrastructure/Dockerfile.mingw +++ b/test-infrastructure/Dockerfile.mingw @@ -7,7 +7,10 @@ # docker compose -f test-infrastructure/docker-compose.yml run --rm build-windows # docker compose -f test-infrastructure/docker-compose.yml run --rm test-windows -FROM mstorsjo/llvm-mingw:latest +# Pinned by digest (supply-chain: no floating tags). This is the multi-arch +# manifest-list digest of mstorsjo/llvm-mingw:latest as of 2026-07-23; bump +# deliberately by re-resolving the digest, never back to a bare tag. +FROM mstorsjo/llvm-mingw:latest@sha256:5cbf421906f889e01c8d4005787474e302df6daa197286ebf212d419024966af # curl+zstd are required (zlib sysroot fetch below). Wine is BEST-EFFORT: it # only runs the .exe, and its i386 packages are unavailable on an arm64 Docker @@ -19,10 +22,16 @@ RUN (dpkg --add-architecture i386 && apt-get update && \ apt-get install -y --no-install-recommends wine64 && rm -rf /var/lib/apt/lists/*) \ || echo "WARN: Wine unavailable on this host arch -> compile-only mode" -# Install zlib into the llvm-mingw sysroot (from MSYS2 CLANG64 repo) +# Install zlib into the llvm-mingw sysroot (from MSYS2 CLANG64 repo). +# The package is verified against its pinned sha256 before extraction — +# a bare curl|tar would execute whatever the mirror serves. RUN mkdir -p /tmp/zlib-pkg && \ curl -sL "https://mirror.msys2.org/mingw/clang64/mingw-w64-clang-x86_64-zlib-1.3.1-1-any.pkg.tar.zst" \ - | zstd -d | tar xf - -C /tmp/zlib-pkg && \ + -o /tmp/zlib.pkg.tar.zst && \ + echo "b7f0c06e6d48128209a3a441f96b92351e565a0d031278c56a8db8a9b5ec291a /tmp/zlib.pkg.tar.zst" \ + | sha256sum -c - && \ + zstd -d < /tmp/zlib.pkg.tar.zst | tar xf - -C /tmp/zlib-pkg && \ + rm /tmp/zlib.pkg.tar.zst && \ cp -rn /tmp/zlib-pkg/clang64/include/* /opt/llvm-mingw/x86_64-w64-mingw32/include/ && \ cp -rn /tmp/zlib-pkg/clang64/lib/* /opt/llvm-mingw/x86_64-w64-mingw32/lib/ && \ rm -rf /tmp/zlib-pkg