Merge branch 'main' into docker_pinned_20260624

2026-07-09 23:12:22 +02:00 · 2026-07-09 11:05:58 +02:00 · 2026-07-04 14:25:49 +02:00 · 2026-07-01 21:53:39 +02:00 · 2026-06-24 18:02:18 +02:00 · 2026-06-24 17:56:13 +02:00
4 changed files with 5 additions and 6 deletions
@@ -1,6 +1,6 @@
 # Stirling-PDF backend-only image — JAR built with -PbuildWithFrontend=false, UI ships separately.

-ARG BASE_VERSION=1.0.2
+ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3d119eb2bf9a82e
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}

 # Stage 1: Build the Java application (backend only, no frontend)
@@ -1,7 +1,7 @@
 # Stirling-PDF - Full version (embedded frontend)
 # Uses pre-built base image for fast builds

-ARG BASE_VERSION=1.0.2
+ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3d119eb2bf9a82e
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}

 # Stage 1: Build the Java application and frontend
@@ -2,7 +2,7 @@
 # Extra fonts for air-gapped environments
 # Uses pre-built base image for fast builds

-ARG BASE_VERSION=1.0.2
+ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3d119eb2bf9a82e
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}

 # Stage 1: Build the Java application and frontend
@@ -54,7 +54,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
      --no-daemon

 # Stage 2: Extract Spring Boot Layers
-FROM eclipse-temurin:25-jre-noble AS jar-extract
+FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29 AS jar-extract
 WORKDIR /tmp
 COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
 RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
@@ -1,6 +1,5 @@
 # syntax=docker/dockerfile:1.5
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
-
+FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim@sha256:531f855bda2c73cd6ef67d56b733b357cea384185b3022bd09f05e002cd144ca
 WORKDIR /app

 COPY pyproject.toml uv.lock ./
Author	SHA1	Message	Date
LudyandGitHub	84f9afa505	Merge branch 'main' into docker_pinned_20260624	2026-07-09 23:12:22 +02:00
LudyandGitHub	49aea95212	Merge branch 'main' into docker_pinned_20260624	2026-07-09 11:05:58 +02:00
LudyandGitHub	b74f033a4a	Merge branch 'main' into docker_pinned_20260624	2026-07-04 14:25:49 +02:00
LudyandGitHub	a8e123b7b8	Merge branch 'main' into docker_pinned_20260624	2026-07-01 21:53:39 +02:00
Ludy87	647bede81c	Use @ digest for BASE_VERSION in Dockerfiles Replace the colon with '@' in BASE_VERSION ARG values to use the proper image digest syntax (tag@sha256:...) across docker/backend/Dockerfile, docker/embedded/Dockerfile, and docker/embedded/Dockerfile.fat. This makes the BASE_IMAGE ARG reference a canonical digest for more reliable and reproducible base image resolution.	2026-06-24 18:02:18 +02:00
Ludy87	aeb027e9ee	Pin base images in Dockerfiles with digests Pin base images to immutable sha256 digests for reproducible and more secure builds. Updated ARG BASE_VERSION to include digest in docker/backend/Dockerfile, docker/embedded/Dockerfile, and docker/embedded/Dockerfile.fat; replaced eclipse-temurin base in embedded/Dockerfile.fat with a sha256-pinned reference; and pinned the ghcr.io/astral-sh/uv base image in engine/Dockerfile.dev.	2026-06-24 17:56:13 +02:00