Skip to content

Commit 76b64a2

Browse files
terion-nameterion-name
committed
Pin annotated hardened image mirrors
1 parent 354df91 commit 76b64a2

9 files changed

Lines changed: 18 additions & 14 deletions

File tree

‎.github/workflows/mirror-hardened-images.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
target: ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13
3131
package: terrarium-dhi-oauth2-proxy
3232
source_digest: sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e
33-
target_digest: auto
33+
target_digest: sha256:e9e04c1aec93e395897ad62625f088bbb8230c440244a4561c76df1305f9b461
3434
arches: amd64,arm64
3535
description: "Mirror of Docker Hardened Image dhi.io/oauth2-proxy:7.15.2-debian13 for pulling without Docker authentication. Original: https://hub.docker.com/hardened-images/catalog/dhi/oauth2-proxy"
3636
original_ref: dhi.io/oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e
@@ -41,7 +41,7 @@ jobs:
4141
target: ghcr.io/terion-name/terrarium-dhi-postgres:17.10-alpine3.22
4242
package: terrarium-dhi-postgres
4343
source_digest: sha256:a8da88e1ff62d2764fc63b0f1b0f912ff06fc629d964a260d876be615bd0857b
44-
target_digest: auto
44+
target_digest: sha256:9de93f210670e25bad3dd650ac435067c7628700cc7485fa0d4fe72b8e9d765d
4545
arches: amd64,arm64
4646
description: "Mirror of Docker Hardened Image dhi.io/postgres:17.10-alpine3.22 for pulling without Docker authentication. Original: https://hub.docker.com/hardened-images/catalog/dhi/postgres"
4747
original_ref: dhi.io/postgres:17.10-alpine3.22@sha256:a8da88e1ff62d2764fc63b0f1b0f912ff06fc629d964a260d876be615bd0857b

‎ansible/roles/idp_zitadel/defaults/main.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ terrarium_docker_registry_config_path: /root/.docker/config.json
1616
terrarium_docker_hardened_images: auto
1717
terrarium_docker_hardened_image_mirrors: true
1818
terrarium_zitadel_postgres_image: ""
19-
terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed"
20-
terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22@sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34"
19+
terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.10-alpine3.22@sha256:a8da88e1ff62d2764fc63b0f1b0f912ff06fc629d964a260d876be615bd0857b"
20+
terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.10-alpine3.22@sha256:9de93f210670e25bad3dd650ac435067c7628700cc7485fa0d4fe72b8e9d765d"
2121
terrarium_zitadel_postgres_image_fallback: "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308"
2222
terrarium_zitadel_pat_expiration: "2099-01-01T00:00:00Z"
2323
terrarium_zitadel_project_name: Terrarium

‎ansible/roles/oauth2_proxy/defaults/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ terrarium_docker_hardened_images: auto
55
terrarium_docker_hardened_image_mirrors: true
66
terrarium_oauth2_proxy_image: ""
77
terrarium_oauth2_proxy_image_hardened: "dhi.io/oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e"
8-
terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de"
8+
terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:e9e04c1aec93e395897ad62625f088bbb8230c440244a4561c76df1305f9b461"
99
terrarium_oauth2_proxy_image_fallback: "quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd"
1010
terrarium_oauth2_proxy_uid: "65532"
1111
terrarium_oauth2_proxy_group: terrarium-oauth2-proxy

‎ansible/site.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,14 +57,14 @@
5757
terrarium_docker_hardened_image_mirrors: true
5858
terrarium_oauth2_proxy_image: ""
5959
terrarium_oauth2_proxy_image_hardened: "dhi.io/oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e"
60-
terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de"
60+
terrarium_oauth2_proxy_image_mirror: "ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:e9e04c1aec93e395897ad62625f088bbb8230c440244a4561c76df1305f9b461"
6161
terrarium_oauth2_proxy_image_fallback: "quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd"
6262
terrarium_oauth2_proxy_uid: "65532"
6363
terrarium_oauth2_proxy_group: terrarium-oauth2-proxy
6464
terrarium_oauth2_proxy_gid: ""
6565
terrarium_zitadel_postgres_image: ""
66-
terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed"
67-
terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22@sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34"
66+
terrarium_zitadel_postgres_image_hardened: "dhi.io/postgres:17.10-alpine3.22@sha256:a8da88e1ff62d2764fc63b0f1b0f912ff06fc629d964a260d876be615bd0857b"
67+
terrarium_zitadel_postgres_image_mirror: "ghcr.io/terion-name/terrarium-dhi-postgres:17.10-alpine3.22@sha256:9de93f210670e25bad3dd650ac435067c7628700cc7485fa0d4fe72b8e9d765d"
6868
terrarium_zitadel_postgres_image_fallback: "postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308"
6969
terrarium_email: ""
7070
terrarium_acme_email: "{{ terrarium_email }}"

‎scripts/terrarium-traefik-sync.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ const ROUTE_AUTH_DIR = "/var/lib/terrarium/oauth2-proxy-routes";
1414
const ROUTE_AUTH_COMPOSE_PATH = `${ROUTE_AUTH_DIR}/docker-compose.yml`;
1515
const ROUTE_AUTH_BASE_PORT = 4181;
1616
const DEFAULT_OAUTH2_PROXY_IMAGE =
17-
"ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de";
17+
"ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:e9e04c1aec93e395897ad62625f088bbb8230c440244a4561c76df1305f9b461";
1818
const DEFAULT_OAUTH2_PROXY_UID = "65532";
1919
const DEFAULT_OAUTH2_PROXY_GROUP = "terrarium-oauth2-proxy";
2020
const ROUTE_AUTH_READY_ATTEMPTS = 12;

‎tests/ansible-bootstrap-cert.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ import { describe, expect, test } from "bun:test";
44

55
const repoRoot = join(import.meta.dir, "..");
66
const POSTGRES_DHI_IMAGE =
7-
"dhi.io/postgres:17.9-alpine3.22@sha256:53e316c761bfcaae02cdc6015c3a11a747fe9d0cde9cd0c3d4c871326862e7ed";
7+
"dhi.io/postgres:17.10-alpine3.22@sha256:a8da88e1ff62d2764fc63b0f1b0f912ff06fc629d964a260d876be615bd0857b";
88
const POSTGRES_MIRROR_IMAGE =
9-
"ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22@sha256:de305976d6a81c4c1ad260861ec5028faafbb1be0bca68ab379eb2fb621abe34";
9+
"ghcr.io/terion-name/terrarium-dhi-postgres:17.10-alpine3.22@sha256:9de93f210670e25bad3dd650ac435067c7628700cc7485fa0d4fe72b8e9d765d";
1010
const POSTGRES_FALLBACK_IMAGE =
1111
"postgres:17.9-alpine3.22@sha256:034839bd88128360cda25496ebdb1471e24a4aa09b937160c73df2bb51126308";
1212

‎tests/hardened-image-mirror.test.ts‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ const repoRoot = join(import.meta.dir, "..");
66

77
const SOURCE_REPO_URL = "https://github.com/terion-name/terrarium";
88
const OAUTH2_PROXY_DIGEST = "sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e";
9+
const OAUTH2_PROXY_TARGET_DIGEST = "sha256:e9e04c1aec93e395897ad62625f088bbb8230c440244a4561c76df1305f9b461";
910
const POSTGRES_DIGEST = "sha256:a8da88e1ff62d2764fc63b0f1b0f912ff06fc629d964a260d876be615bd0857b";
11+
const POSTGRES_TARGET_DIGEST = "sha256:9de93f210670e25bad3dd650ac435067c7628700cc7485fa0d4fe72b8e9d765d";
1012
const OAUTH2_PROXY_DESCRIPTION =
1113
"Mirror of Docker Hardened Image dhi.io/oauth2-proxy:7.15.2-debian13 for pulling without Docker authentication. Original: https://hub.docker.com/hardened-images/catalog/dhi/oauth2-proxy";
1214
const POSTGRES_DESCRIPTION =
@@ -45,12 +47,14 @@ describe("Docker Hardened Image mirror workflow", () => {
4547
expect(workflow).not.toContain(`source: dhi.io/oauth2-proxy:7.15.2-debian13@${OAUTH2_PROXY_DIGEST}`);
4648
expect(workflow).toContain("target: ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13");
4749
expect(workflow).toContain(`source_digest: ${OAUTH2_PROXY_DIGEST}`);
50+
expect(workflow).toContain(`target_digest: ${OAUTH2_PROXY_TARGET_DIGEST}`);
4851
expect(workflow).toContain(`source: dhi.io/postgres@${POSTGRES_DIGEST}`);
4952
expect(workflow).not.toContain("17.9-alpine3.22-fips");
5053
expect(workflow).not.toContain("target: ghcr.io/terion-name/terrarium-dhi-postgres:17.9-alpine3.22");
5154
expect(workflow).toContain("target: ghcr.io/terion-name/terrarium-dhi-postgres:17.10-alpine3.22");
5255
expect(workflow).toContain(`source_digest: ${POSTGRES_DIGEST}`);
53-
expect(workflow.match(/target_digest: auto/g)).toHaveLength(2);
56+
expect(workflow).toContain(`target_digest: ${POSTGRES_TARGET_DIGEST}`);
57+
expect(workflow).not.toContain("target_digest: auto");
5458
expect(workflow.match(/arches: amd64,arm64/g)).toHaveLength(2);
5559

5660
expect(script).toContain("skopeo inspect --raw");

‎tests/oauth2-proxy-template.test.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import { describe, expect, test } from "bun:test";
55
const OAUTH2_PROXY_DHI_IMAGE =
66
"dhi.io/oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e";
77
const OAUTH2_PROXY_MIRROR_IMAGE =
8-
"ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de";
8+
"ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:e9e04c1aec93e395897ad62625f088bbb8230c440244a4561c76df1305f9b461";
99
const OAUTH2_PROXY_FALLBACK_IMAGE =
1010
"quay.io/oauth2-proxy/oauth2-proxy:v7.15.2@sha256:aa0bd8dd5ab0c78e4c91c92755ad573a5f92241f88138b4141b8ec803463b4fd";
1111

‎tests/terrarium-traefik-sync.test.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ const routeAuthConfig = {
3232
const OAUTH2_PROXY_DHI_IMAGE =
3333
"dhi.io/oauth2-proxy:7.15.2-debian13@sha256:8f4e89762735e7ec7c3f1bbdd5da4dcd55358db8c3278bfbc2e46a7f86ab7d9e";
3434
const OAUTH2_PROXY_MIRROR_IMAGE =
35-
"ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:c5ec2ff7b486e72e7e6868efdc4c058f6280dba2ea472751c639d7b0e2bd43de";
35+
"ghcr.io/terion-name/terrarium-dhi-oauth2-proxy:7.15.2-debian13@sha256:e9e04c1aec93e395897ad62625f088bbb8230c440244a4561c76df1305f9b461";
3636

3737
function container(name: string, proxy: string, address = "10.10.0.10") {
3838
return {

0 commit comments

Comments
 (0)