From 9158532c9d352334d74991f5c34863bf816d0202 Mon Sep 17 00:00:00 2001 From: veilor-org Date: Wed, 6 May 2026 10:41:10 +0100 Subject: [PATCH] ci: pin fedora:43 base image to digest Pin registry.fedoraproject.org/fedora:43 to its current manifest digest so a malicious or accidental tag-rewrite upstream cannot silently change the base layer of every CI build. Digest was captured via `skopeo inspect --raw` on 2026-05-06. Refresh procedure documented inline. --- .github/workflows/build-iso.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml index d2c11b0..46ac1fa 100644 --- a/.github/workflows/build-iso.yml +++ b/.github/workflows/build-iso.yml @@ -48,7 +48,9 @@ jobs: # SHA pinning in a follow-up sweep. uses: addnab/docker-run-action@v3 with: - image: registry.fedoraproject.org/fedora:43 + # Pinned to digest from `skopeo inspect --raw` on 2026-05-06. + # Refresh by re-running skopeo against fedora:43 and bumping. + image: registry.fedoraproject.org/fedora:43@sha256:72e874e771b953c6357c7a5823c6fc1e3e3253b90121e795febe01380e32269b options: | --privileged -v ${{ github.workspace }}:/work