"How do you know that the image you build is really the one you mean?" – every serious NIS2 or ISO 27001 auditor asks this question. The SecTepe platform (SecTepe.Comm) now answers it in a technically verifiable way: a moved or compromised upstream tag can no longer silently change a build.
Base Images Pinned by Manifest Digest
123 of 128 FROM base images in the own Dockerfiles are pinned by manifest digest (image:tag@sha256:…). A new resolver (resolve-image-digest.py) implements the Registry v2 bearer flow and reliably returns the multi-arch index digest. A pre-commit hook (base-image-pinning) enforces pinning for new or changed Dockerfiles; five documented exceptions are kept in an allowlist.
GitHub Actions Are Pinned Too
Movable action references are an underestimated attack surface. That is why mutable refs were pinned to commit SHAs – for example aquasecurity/trivy-action@master in 62 occurrences across 45 workflows to a fixed commit, and trufflehog@main to a fixed version. This means a changed tag in a third-party action can no longer flow unnoticed into the own CI.
334 Image Pins Reconciled
In a full registry reconciliation, all 334 image: pins were checked, 302 pins in 165 files raised, and divergent pins of the same image unified. The named updates include Synapse, Wazuh, Traefik, Velero, OpenSearch, Jitsi, and oauth2-proxy. Database majors (Postgres, Redis, RabbitMQ, MySQL/MariaDB) were deliberately held back because they require a data migration – hardening without operational risk.
Embedded in Provable Provenance
Digest pinning is part of a bigger picture: the platform attests SLSA Level 3, CycloneDX and SPDX SBOMs, Cosign-signed images, and DCO sign-off. This is complemented by the shared advisory format that feeds the "are WE affected?" CI gate – details in the post on the supply-chain advisory pipeline.
Conclusion
With pinned base images, pinned actions, and 334 reconciled pins, the SecTepe platform's supply chain becomes verifiable instead of trust-based. That is the concrete, auditable answer to the supply-chain requirements of NIS2 and ISO 27001 – not a promise but a reproducible build.