build: pin and verify image inputs

2026-07-26 09:24:44 +00:00
parent 69c4c85cd5
commit 10d295eaf6
17 changed files with 172 additions and 38 deletions
@@ -16,9 +16,11 @@
 # secret-dense control plane on a minimal dependency surface is the point
 # (PRD 0070's "secret concentration").
 #
-# Shares the trixie `python:3.12-slim` base with the gateway image.
+# Shares an exact multi-architecture Python/trixie manifest with the gateway
+# image. The version-qualified tag keeps the human-readable upstream version;
+# the digest makes the bytes immutable.

-FROM python:3.12-slim
+FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de

 WORKDIR /app