Supply-Chain Hardening: Digest Pinning

"How do you know that the image you build is really the one you mean?" Every serious NIS2 or ISO 27001 auditor asks this. The SecTepe platform (SecTepe.Comm) now gives an answer you can check on a technical level. An upstream tag that was moved or compromised can no longer change a build without anyone noticing.

Base Images Pinned by Manifest Digest

123 of 128 FROM base images in our own Dockerfiles are pinned by manifest digest (image:tag@sha256:…). Three tools make this work:

A new resolver (resolve-image-digest.py) runs the Registry v2 bearer flow. It reliably returns the multi-arch index digest.
A pre-commit hook (base-image-pinning) enforces pinning for new or changed Dockerfiles.
An allowlist holds the five exceptions, each one on record.

GitHub Actions Are Pinned Too

Action references that can move are an attack surface that people tend to miss. So we pinned refs that can change to commit SHAs. Two examples:

aquasecurity/trivy-action@master now points to a fixed commit in 62 places across 45 workflows.
trufflehog@main now points to a fixed version.

A changed tag in a third-party action can no longer slip into our own CI unseen.

334 Image Pins Lined Up

We ran a full check against the registry. All 334 image: pins were checked. 302 pins in 165 files were raised to newer versions. Where the same image had pins that did not match, we made them the same. The named updates include Synapse, Wazuh, Traefik, Velero, OpenSearch, Jitsi, and oauth2-proxy.

We held back major database versions on purpose: Postgres, Redis, RabbitMQ, and MySQL/MariaDB. They need a data migration. That is hardening with no risk to operations.

Part of Provenance You Can Prove

Digest pinning is part of a bigger picture. The platform attests to:

signed SLSA build provenance (verifiable with cosign or gh attestation verify),
CycloneDX and SPDX SBOMs,
Cosign-signed images,
and DCO sign-off.

The shared advisory format adds to this. It feeds the "are WE affected?" CI gate. You'll find details in the post on the supply-chain advisory pipeline.

Conclusion

Base images and actions are pinned, and 334 pins are lined up. That makes the SecTepe platform's supply chain something you can check, not something you have to trust. It is a clear answer you can audit to the supply-chain rules of NIS2 and ISO 27001. It is not a promise. It is a build you can reproduce.