6675f2a169
- Updated Docker Compose files to use digest-pinned images for CI contexts. - Enhanced Dockerfile to pin Go tool installations and verify external downloads with SHA256 checksums. - Added Renovate configuration for tracking Go tool versions and digest updates. - Introduced a new design document outlining the architecture and data flow for dependency tracking. - Created tasks and requirements documentation to ensure compliance with the new digest pinning policy. - Updated security documentation to reflect the new digest pinning policy and exceptions.
824 B
824 B
Tasks - Dependency Digest Tracking Plan
Phase 2 - Pinning & Verification Updates
- Pin
dlvandxcaddyversions in Dockerfile. - Add checksum verification for CrowdSec fallback tarball.
- Add checksum verification for GeoLite2 database download.
- Pin CI compose images by digest.
- Default Playwright CI compose to workflow digest output with tag override for local runs.
- Pin whoami test service image by digest in docker-build workflow.
- Propagate nightly image digest to smoke tests and scans.
- Pin
govulncheckandgoplsversions in scripts. - Add Renovate regex managers for pinned tool versions and go.work.
Follow-ups
- Add policy linting to detect unpinned tags in CI-critical files.
- Update security documentation for digest policy and exceptions.