Merge pull request #583 from securesign/eli/baseImageMain

Elijah-Destigni · web-flow · commit 0daeac83c43f · 2026-02-24T14:00:51.000Z
[CVE Surface Reduction] Image Updates Main
diff --git a/Dockerfile.createtree.rh b/Dockerfile.createtree.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.7 AS build
+FROM registry.redhat.io/ubi9/go-toolset:9.7@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc AS build
 ENV APP_ROOT=/opt/app-root \
     GOPATH=/opt/app-root \
     CGO_ENABLED=1 \
@@ -19,7 +19,7 @@ RUN go mod download && \
     gzip createtree-windows-amd64.exe
 
 # Multi-Stage production build
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:bb08f2300cb8d12a7eb91dddf28ea63692b3ec99e7f0fa71a1b300f2756ea829 AS deploy
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:c7d44146f826037f6873d99da479299b889473492d3c1ab8af86f08af04ec8a0 AS deploy
 
 # Add license file
 COPY LICENSE /licenses/LICENSE
diff --git a/Dockerfile.database.rh b/Dockerfile.database.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/rhel9/mariadb-105@sha256:fcd896292e9d4c1fa53156436c47fac3fedf4a1d7d7ec3d607a8160b5cef3b83
+FROM registry.redhat.io/rhel9/mariadb-105@sha256:0bfc5429881f8057398bb41b5e699c9327b3483d412af2db194a0b0798674221
 
 USER root
 
diff --git a/Dockerfile.logserver.rh b/Dockerfile.logserver.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.7@sha256:359dd4c6c4255b3f7bce4dc15ffa5a9aa65a401f819048466fa91baa8244a793 AS builder
+FROM registry.redhat.io/ubi9/go-toolset:9.7@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 ENV CGO_ENABLED=1
@@ -16,7 +16,7 @@ ADD ./ $APP_ROOT/src/
 RUN go build -mod=mod -v ./cmd/trillian_log_server
 
 # Multi-Stage production build
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:bb08f2300cb8d12a7eb91dddf28ea63692b3ec99e7f0fa71a1b300f2756ea829 AS deploy
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:c7d44146f826037f6873d99da479299b889473492d3c1ab8af86f08af04ec8a0 AS deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/trillian_log_server /
diff --git a/Dockerfile.logsigner.rh b/Dockerfile.logsigner.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.7@sha256:359dd4c6c4255b3f7bce4dc15ffa5a9aa65a401f819048466fa91baa8244a793 AS builder
+FROM registry.redhat.io/ubi9/go-toolset:9.7@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 ENV CGO_ENABLED=1
@@ -16,7 +16,7 @@ ADD ./ $APP_ROOT/src/
 RUN go build -mod=mod -v ./cmd/trillian_log_signer 
 
 # Multi-Stage production build
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:bb08f2300cb8d12a7eb91dddf28ea63692b3ec99e7f0fa71a1b300f2756ea829 AS deploy
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:c7d44146f826037f6873d99da479299b889473492d3c1ab8af86f08af04ec8a0 AS deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/trillian_log_signer /
diff --git a/Dockerfile.netcat.rh b/Dockerfile.netcat.rh
@@ -1,4 +1,4 @@
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:bb08f2300cb8d12a7eb91dddf28ea63692b3ec99e7f0fa71a1b300f2756ea829
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:c7d44146f826037f6873d99da479299b889473492d3c1ab8af86f08af04ec8a0
 
 LABEL description="Netcat is a computer networking utility for reading from and writing to network connections using TCP or UDP."
 LABEL io.k8s.description="netcat is a computer networking utility for reading from and writing to network connections using TCP or UDP."
diff --git a/Dockerfile.redis.rh b/Dockerfile.redis.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/rhel9/redis-6@sha256:0c9db54a0ec18917e0ed82bf85e9a08ddc570fcccb2e2086683aeba3db284e27
+FROM registry.redhat.io/rhel9/redis-6@sha256:3120501cce2159fddb8ffe6453ef1ddb05309b061d261345672da40b5aea3ee5
 
 LABEL description="Securesign redis is built ontop of rhel9/redis-6 but accepts external connections and runs appendonly mode with full durability."
 LABEL io.k8s.description="Securesign redis is built ontop of rhel9/redis-6 but accepts external connections and runs appendonly mode with full durability."
diff --git a/Dockerfile.updatetree.rh b/Dockerfile.updatetree.rh
@@ -1,4 +1,4 @@
-FROM registry.redhat.io/ubi9/go-toolset:9.7 AS build
+FROM registry.redhat.io/ubi9/go-toolset:9.7@sha256:799cc027d5ad58cdc156b65286eb6389993ec14c496cf748c09834b7251e78dc AS build
 ENV APP_ROOT=/opt/app-root \
     GOPATH=/opt/app-root \
     CGO_ENABLED=1 \
@@ -19,7 +19,7 @@ RUN go mod download && \
     gzip updatetree-windows-amd64.exe
 
 # Multi-Stage production build
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:bb08f2300cb8d12a7eb91dddf28ea63692b3ec99e7f0fa71a1b300f2756ea829 AS deploy
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:c7d44146f826037f6873d99da479299b889473492d3c1ab8af86f08af04ec8a0 AS deploy
 
 # Add license file
 COPY LICENSE /licenses/LICENSE

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM registry.redhat.io/rhel9/mariadb-105@sha256:fcd896292e9d4c1fa53156436c47fac3fedf4a1d7d7ec3d607a8160b5cef3b83`
	`1`	`+FROM registry.redhat.io/rhel9/mariadb-105@sha256:0bfc5429881f8057398bb41b5e699c9327b3483d412af2db194a0b0798674221`
`2`	`2`
`3`	`3`	`USER root`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:bb08f2300cb8d12a7eb91dddf28ea63692b3ec99e7f0fa71a1b300f2756ea829`
	`1`	`+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:c7d44146f826037f6873d99da479299b889473492d3c1ab8af86f08af04ec8a0`
`2`	`2`
`3`	`3`	`LABEL description="Netcat is a computer networking utility for reading from and writing to network connections using TCP or UDP."`
`4`	`4`	`LABEL io.k8s.description="netcat is a computer networking utility for reading from and writing to network connections using TCP or UDP."`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM registry.redhat.io/rhel9/redis-6@sha256:0c9db54a0ec18917e0ed82bf85e9a08ddc570fcccb2e2086683aeba3db284e27`
	`1`	`+FROM registry.redhat.io/rhel9/redis-6@sha256:3120501cce2159fddb8ffe6453ef1ddb05309b061d261345672da40b5aea3ee5`
`2`	`2`
`3`	`3`	`LABEL description="Securesign redis is built ontop of rhel9/redis-6 but accepts external connections and runs appendonly mode with full durability."`
`4`	`4`	`LABEL io.k8s.description="Securesign redis is built ontop of rhel9/redis-6 but accepts external connections and runs appendonly mode with full durability."`