diff --git a/Dockerfile.createtree.rh b/Dockerfile.createtree.rh index 9363ee2ee1..9d6f84069d 100644 --- a/Dockerfile.createtree.rh +++ b/Dockerfile.createtree.rh @@ -1,4 +1,4 @@ -FROM registry.redhat.io/ubi9/go-toolset:9.8-1783931515@sha256:c6b19c92a8613bcfdf69ef00a6ea94ac689ec76d07758d71416c1faa6f35f431 AS build-env +FROM registry.redhat.io/ubi9/go-toolset:9.8-1785791459@sha256:46376c6723c3a4961a165c2768461e7fac48a79932cdde0a6e6a57724ef61ba0 AS build-env ENV APP_ROOT=/opt/app-root ENV GOPATH=$APP_ROOT ENV CGO_ENABLED=1 @@ -23,7 +23,7 @@ RUN go mod download && \ gzip createtree-windows-amd64.exe # Multi-Stage production build -FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:463cae32c6f6f5594b11a5c22de275016bd8545ce58a6373388e8b24f13fc15c AS deploy +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1 AS deploy # Retrieve the binary from the previous stage COPY --from=build-env /opt/app-root/src/createtree / diff --git a/Dockerfile.database.rh b/Dockerfile.database.rh index 54b53945cd..a3355921cb 100644 --- a/Dockerfile.database.rh +++ b/Dockerfile.database.rh @@ -1,4 +1,4 @@ -FROM registry.redhat.io/rhel9/mariadb-105@sha256:eae6de039c916b71c3774a8085ccf0e10fbf9e85b3c85cbf1855c04216e8cc68 +FROM registry.redhat.io/rhel9/mariadb-105@sha256:05eaf1ee15c8bb8a83b528a2c092ae054579560ad5895223f313a5768ef3f86a USER root diff --git a/Dockerfile.logserver.rh b/Dockerfile.logserver.rh index 52c552d2af..df81fa4a95 100644 --- a/Dockerfile.logserver.rh +++ b/Dockerfile.logserver.rh @@ -1,4 +1,4 @@ -FROM registry.redhat.io/ubi9/go-toolset:9.8-1783931515@sha256:c6b19c92a8613bcfdf69ef00a6ea94ac689ec76d07758d71416c1faa6f35f431 AS builder +FROM registry.redhat.io/ubi9/go-toolset:9.8-1785791459@sha256:46376c6723c3a4961a165c2768461e7fac48a79932cdde0a6e6a57724ef61ba0 AS builder ENV APP_ROOT=/opt/app-root ENV GOPATH=$APP_ROOT ENV CGO_ENABLED=1 @@ -16,7 +16,7 @@ ADD ./ $APP_ROOT/src/ RUN go build -mod=mod -v ./cmd/trillian_log_server # Multi-Stage production build -FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:463cae32c6f6f5594b11a5c22de275016bd8545ce58a6373388e8b24f13fc15c AS deploy +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1 AS deploy # Retrieve the binary from the previous stage COPY --from=builder /opt/app-root/src/trillian_log_server / diff --git a/Dockerfile.logsigner.rh b/Dockerfile.logsigner.rh index da73bb7f55..4d709ca88d 100644 --- a/Dockerfile.logsigner.rh +++ b/Dockerfile.logsigner.rh @@ -1,4 +1,4 @@ -FROM registry.redhat.io/ubi9/go-toolset:9.8-1783931515@sha256:c6b19c92a8613bcfdf69ef00a6ea94ac689ec76d07758d71416c1faa6f35f431 AS builder +FROM registry.redhat.io/ubi9/go-toolset:9.8-1785791459@sha256:46376c6723c3a4961a165c2768461e7fac48a79932cdde0a6e6a57724ef61ba0 AS builder ENV APP_ROOT=/opt/app-root ENV GOPATH=$APP_ROOT ENV CGO_ENABLED=1 @@ -16,7 +16,7 @@ ADD ./ $APP_ROOT/src/ RUN go build -mod=mod -v ./cmd/trillian_log_signer # Multi-Stage production build -FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:463cae32c6f6f5594b11a5c22de275016bd8545ce58a6373388e8b24f13fc15c AS deploy +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1 AS deploy # Retrieve the binary from the previous stage COPY --from=builder /opt/app-root/src/trillian_log_signer / diff --git a/Dockerfile.netcat.rh b/Dockerfile.netcat.rh index 7511fab925..5c66141b67 100644 --- a/Dockerfile.netcat.rh +++ b/Dockerfile.netcat.rh @@ -1,4 +1,4 @@ -FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:463cae32c6f6f5594b11a5c22de275016bd8545ce58a6373388e8b24f13fc15c +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1 LABEL description="Netcat is a computer networking utility for reading from and writing to network connections using TCP or UDP." diff --git a/Dockerfile.redis.rh b/Dockerfile.redis.rh index d0507b90ac..f28f7402de 100644 --- a/Dockerfile.redis.rh +++ b/Dockerfile.redis.rh @@ -1,4 +1,4 @@ -FROM registry.redhat.io/rhel9/redis-6@sha256:3f9e2b4637085be73cdcd2d9425dab937825380753e57271ef5c58519e9e6483 +FROM registry.redhat.io/rhel9/redis-6@sha256:a6349fc0eee7cb05f8524344f556be81b86ee66f43612e76a1294c302735afde LABEL description="Securesign redis is built ontop of rhel9/redis-6 but accepts external connections and runs appendonly mode with full durability." LABEL io.k8s.description="Securesign redis is built ontop of rhel9/redis-6 but accepts external connections and runs appendonly mode with full durability." diff --git a/Dockerfile.updatetree.rh b/Dockerfile.updatetree.rh index 123d69ff53..e428becb62 100644 --- a/Dockerfile.updatetree.rh +++ b/Dockerfile.updatetree.rh @@ -1,4 +1,4 @@ -FROM registry.redhat.io/ubi9/go-toolset:9.8-1783931515@sha256:c6b19c92a8613bcfdf69ef00a6ea94ac689ec76d07758d71416c1faa6f35f431 AS build-env +FROM registry.redhat.io/ubi9/go-toolset:9.8-1785791459@sha256:46376c6723c3a4961a165c2768461e7fac48a79932cdde0a6e6a57724ef61ba0 AS build-env ENV APP_ROOT=/opt/app-root ENV GOPATH=$APP_ROOT ENV CGO_ENABLED=1 @@ -24,7 +24,7 @@ RUN go mod download && \ # Multi-Stage production build -FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:463cae32c6f6f5594b11a5c22de275016bd8545ce58a6373388e8b24f13fc15c AS deploy +FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:dd334afa72444fa46238fcf9e6bd399245adf746378735348cf84b9dfdca38f1 AS deploy # Retrieve the binary from the previous stage COPY --from=build-env /opt/app-root/src/updatetree / diff --git a/examples/deployment/docker/db_server/Dockerfile b/examples/deployment/docker/db_server/Dockerfile index 0b6395d409..24b18f823f 100644 --- a/examples/deployment/docker/db_server/Dockerfile +++ b/examples/deployment/docker/db_server/Dockerfile @@ -1,4 +1,4 @@ -FROM mysql:9.7@sha256:ae269281abffe401d65f04cb54d45a069a495b8174b9c0a815e502fed7fa0370 +FROM mysql:9.7@sha256:257388edf9c84dbc04c763625446d5f3fa6ed60d1b0873bc552c614ba0a7ab4e # TODO(roger2hk): Uncomment the below OS-level packages patch command as this is a temporary workaround to bypass the mysql8 gpg key rotation issue. diff --git a/examples/deployment/docker/db_server/postgresql/Dockerfile b/examples/deployment/docker/db_server/postgresql/Dockerfile index 4d7d406b39..2f1fb61d99 100644 --- a/examples/deployment/docker/db_server/postgresql/Dockerfile +++ b/examples/deployment/docker/db_server/postgresql/Dockerfile @@ -1,4 +1,4 @@ -FROM postgres:17.10@sha256:0af65001d05296a2ead57ac4a6412433d8913d1bb5d0c88435a7d1e1ee5cb04b +FROM postgres:17.10@sha256:7958605b474b3d264a969cb3a123d6aa00ad1e1fe9da8a69984dabb704d93317 # expects the build context to be: $GOPATH/src/github.com/google/trillian COPY storage/postgresql/schema/storage.sql /docker-entrypoint-initdb.d/storage.sql diff --git a/examples/deployment/docker/log_server/Dockerfile b/examples/deployment/docker/log_server/Dockerfile index 4456bbc25a..791a456675 100644 --- a/examples/deployment/docker/log_server/Dockerfile +++ b/examples/deployment/docker/log_server/Dockerfile @@ -18,7 +18,7 @@ RUN go install ./cmd/trillian_log_server RUN go run github.com/google/go-licenses/v2 save ./cmd/trillian_log_server --save_path /THIRD_PARTY_NOTICES # Make a minimal image. -FROM gcr.io/distroless/base-debian12@sha256:9c05cfd65f41c93a909ea67eb05b920a3b838780ea55df5421d48295d98ff957 +FROM gcr.io/distroless/base-debian12@sha256:62730825d3cf03571e0a1b8f014748de94d0404500f063593b614c23da38841d COPY --from=build /go/bin/trillian_log_server / COPY --from=build /THIRD_PARTY_NOTICES /THIRD_PARTY_NOTICES diff --git a/examples/deployment/docker/log_signer/Dockerfile b/examples/deployment/docker/log_signer/Dockerfile index 18dd219e68..25b4f8db8a 100644 --- a/examples/deployment/docker/log_signer/Dockerfile +++ b/examples/deployment/docker/log_signer/Dockerfile @@ -18,7 +18,7 @@ RUN go install ./cmd/trillian_log_signer RUN go run github.com/google/go-licenses/v2 save ./cmd/trillian_log_signer --save_path /THIRD_PARTY_NOTICES # Make a minimal image. -FROM gcr.io/distroless/base-debian12@sha256:9c05cfd65f41c93a909ea67eb05b920a3b838780ea55df5421d48295d98ff957 +FROM gcr.io/distroless/base-debian12@sha256:62730825d3cf03571e0a1b8f014748de94d0404500f063593b614c23da38841d COPY --from=build /go/bin/trillian_log_signer / COPY --from=build /THIRD_PARTY_NOTICES /THIRD_PARTY_NOTICES diff --git a/examples/deployment/kubernetes/mysql/image/Dockerfile b/examples/deployment/kubernetes/mysql/image/Dockerfile index db1f256241..22cb6913b7 100644 --- a/examples/deployment/kubernetes/mysql/image/Dockerfile +++ b/examples/deployment/kubernetes/mysql/image/Dockerfile @@ -13,7 +13,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 +FROM ubuntu:noble@sha256:561618e2c15bf2397621dd04f96926663a3b5616c189cf7e38db7e82f5c538ea # Patch the OS-level packages and remove unneeded dependencies. RUN apt-get update \