From d34c3d16a68a9f56221a96e08cfa2cf3c1bafe3b Mon Sep 17 00:00:00 2001 From: egibs <20933572+egibs@users.noreply.github.com> Date: Mon, 17 Aug 2026 12:54:08 +0000 Subject: [PATCH] chore(oscap): re-pin fixture base-image digests Re-pins the digest-pinned FROM lines in tests/e2e/fixtures/*/Dockerfile and the pinned wolfi-base digest in the offline harness test (TestParseWolfiBaseRef) together, so the two can never drift out of sync and break the offline unit tests. Both stamp files CertificateAudit reads were checked first, on cgr.dev/chainguard/jre:latest: the CA bundle matches /etc/ssl/certs/.ca-certificates.crt.sha256 and the Java truststore matches /etc/ssl/certs/java/.cacerts.sha256. Image: cgr.dev/chainguard/wolfi-base:latest Digest: sha256:0a8fd427de5882aed77471b0a432c3675eda6b6a0ae952b5d640b46da628cdbe Stamp image: cgr.dev/chainguard/jre:latest CA SHA: 61efbd6d3f829f71039c57b29dd37d15ac7f33c4ece861aaef8c7d7a519cd1d9 Signed-off-by: github-actions[bot] --- tests/e2e/fixtures/cabundle-kaniko/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/e2e/fixtures/cabundle-kaniko/Dockerfile b/tests/e2e/fixtures/cabundle-kaniko/Dockerfile index 92bf54d..86fb486 100644 --- a/tests/e2e/fixtures/cabundle-kaniko/Dockerfile +++ b/tests/e2e/fixtures/cabundle-kaniko/Dockerfile @@ -11,7 +11,7 @@ # CertificateAudit accepts the alternative location only when the copy carries # the digest the ca-certificates stamp file at /etc/ssl/certs records, which an # untouched copy does. The rule must therefore PASS. -FROM cgr.dev/chainguard/wolfi-base:latest@sha256:07e60ff6586b56f03c625e27b604f9f7d29498fef32f099f6560f0d207b4a056 +FROM cgr.dev/chainguard/wolfi-base:latest@sha256:0a8fd427de5882aed77471b0a432c3675eda6b6a0ae952b5d640b46da628cdbe # Suppress OrbStack's automatic root-CA injection so the bundle (and the copy # taken from it) is identical to the upstream wolfi-base bundle the stamp file