What the developer wrote
Authored by odudex
fix: pin gcc base image by digest
What changed, and why it matters
This change locks the Docker build to one specific, unchangeable version of the GCC compiler image by adding a cryptographic fingerprint (SHA digest). Without this, an attacker who compromises the GCC image registry could silently replace the 'gcc:12-bookworm' image with a malicious one, potentially injecting backdoors into Krux firmware builds. Pinning by digest prevents the build from accepting a substituted image, but it does not fix any already-known vulnerability in the code itself.
Adopt digest pinning for all base images and consider also pinning apt package versions, verifying checksums of downloaded toolchains, and using reproducible/verified build pipelines. This commit is a good incremental hardening step and should be merged.
Security signals we found
Docker base image changed from mutable tag to digest-pinned reference
Supply-chain / build-integrity hardening
Prevents registry tag-replacement attacks for the gcc:12-bookworm image
No runtime code or cryptographic logic changed
Evidence from the diff
The Dockerfile’s base image reference changed from a mutable tag (gcc:12-bookworm) to an immutable digest-pinned reference (gcc:12-bookworm@sha256:…). This is a supply-chain hardening measure: Docker tags can be repointed to different image manifests, whereas a digest uniquely identifies a manifest. If a registry or upstream image is compromised, builds using the tag could fetch a tampered compiler/toolchain. The digest pin removes that vector for this base image. The patch is narrow and does not pin other images, dependencies, or apt packages, nor does it add verification steps beyond Docker’s normal digest resolution.
Changed components
Dockerfile build-base stagegcc:12-bookworm base image referenceInspect captured patch +1 / −1
diff --git a/Dockerfile b/Dockerfile
index 0ed6f09..dd2eab6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,7 +26,7 @@
# build-base
# install kendryte (k210), cmake and python dependencies
############
-FROM gcc:12-bookworm AS build-base
+FROM gcc:12-bookworm@sha256:112aacdc53e949b9d2ccefb9ed64930a7fda5e10e007430f244be27e0263220b AS build-base
RUN apt-get update -y && \
apt-get install --no-install-recommends -y -q \
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.