fix(fuzz): pin the ClusterFuzzLite base image by digest - #99
Merged
Conversation
`.clusterfuzzlite/Dockerfile` was the one dependency here fetched by a mutable reference. Scorecard reports it as PinnedDependenciesID, and unlike the other open alerts in this repository it is not a false positive: the image really can change under the build. This repository runs a CI job named "hadolint refuses an unpinned image", so the house rule is not in doubt. The Dockerfile arrived with the fuzz harnesses in fcefc99 with no reasoning recorded for the exception. OSS-Fuzz publishes base-builder:v1 as a rolling tag and expects projects to track it, so this trades automatic base updates for a reproducible image -- the same trade already made for every action and download here. The digest is confirmed twice: the registry's docker-content-digest header for :v1 and Scorecard's remediation tip agree. Claude-Session: https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.clusterfuzzlite/Dockerfilewas the one dependency in this repository fetched by a mutable reference:FROM gcr.io/oss-fuzz-base/base-builder:v1. Scorecard reports it asPinnedDependenciesID, and unlike the other open alerts here it is not a false positive — the image really can change under the build.This repository runs a CI job called "hadolint refuses an unpinned image", so the house rule is not in doubt. The Dockerfile arrived with the fuzz harnesses in
fcefc99and no reasoning was recorded for the exception, which reads as an oversight rather than a decision.The trade is real and worth stating: OSS-Fuzz publishes
base-builder:v1as a rolling tag and expects projects to track it, so pinning exchanges automatic base updates for a reproducible image. That is the same trade this repository already makes for every action and every download, and a stale fuzzing base fails loudly rather than silently.The digest is confirmed twice over: the registry's own
docker-content-digestheader for:v1and Scorecard's remediation tip agree onsha256:8b4a73d8…. The comment records the refresh command so the next person reads the digest from the registry rather than copying one out of a message.https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX