-
Notifications
You must be signed in to change notification settings - Fork 565
Description
Describe the bug
Pinned-Dependencies check does not correctly report the remediation for snippets such as FROM alpine as build
in Dockerfiles.
Using named build stages as in FROM alpine as build
results in a incomplete remediation report:
Warn: containerImage not pinned by hash: Dockerfile:{line}
While using FROM alpine
results in a complete remediation report:
Warn: containerImage not pinned by hash: Dockerfile:{line}: pin your Docker image by updating alpine to alpine@sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126
Reproduction steps
Steps to reproduce the behavior:
- Create a Dockerfile with 2 lines, one
FROM alpine as build
and anotherFROM alpine
. - Run [email protected] detailed report
- Check Pinned-Dependencies check details
- Verify in report the
FROM alpine as build
line does NOT report the remediation suggesting the sha256 - Verify in report the
FROM alpine
line does report the remediation suggesting the sha256
Expected behavior
I expect FROM alpine as build
example and other named build stages to report the remediation suggesting the sha256.
Additional context
None.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status