From 4958996ac13b2bcc72ec869deceeb60cf44e1acd Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Fri, 11 Sep 2026 03:39:48 +0500 Subject: [PATCH] fix(fuzz): pin the ClusterFuzzLite base image by digest `.clusterfuzzlite/Dockerfile` was the one dependency here fetched by a mutable reference. Scorecard reports it as PinnedDependenciesID, and unlike the other open alerts in this repository it is not a false positive: the image really can change under the build. This repository runs a CI job named "hadolint refuses an unpinned image", so the house rule is not in doubt. The Dockerfile arrived with the fuzz harnesses in fcefc99 with no reasoning recorded for the exception. OSS-Fuzz publishes base-builder:v1 as a rolling tag and expects projects to track it, so this trades automatic base updates for a reproducible image -- the same trade already made for every action and download here. The digest is confirmed twice: the registry's docker-content-digest header for :v1 and Scorecard's remediation tip agree. Claude-Session: https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX --- .clusterfuzzlite/Dockerfile | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile index ff2119d..114d646 100644 --- a/.clusterfuzzlite/Dockerfile +++ b/.clusterfuzzlite/Dockerfile @@ -1,4 +1,11 @@ -FROM gcr.io/oss-fuzz-base/base-builder:v1 +# Pinned by digest, like every other dependency here. OSS-Fuzz publishes +# base-builder:v1 as a rolling tag and expects projects to track it, so this +# trades automatic base updates for a reproducible fuzzing image -- the same +# trade this repository already makes for actions and downloads. Refresh with +# the digest the registry reports for :v1, never one copied from a message: +# curl -sSI https://gcr.io/v2/oss-fuzz-base/base-builder/manifests/v1 \ +# -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' +FROM gcr.io/oss-fuzz-base/base-builder:v1@sha256:8b4a73d83374b298a0a771eeec9a1d44ceff3416a678b7d7946303389d022aca COPY . $SRC/ci-workflows WORKDIR $SRC/ci-workflows COPY .clusterfuzzlite/build.sh $SRC/