#514 Security hardening: pin base images and toolchains by digest

[Anonymous]

Originally created by: athanclark

Base images and toolchains are pinned by tag, not by digest.

• Base images by tag: node:24-bookworm-slim, rust:1-bookworm, postgres:16-bookworm, debian:trixie, and archlinux:latest in release.yml:189.
• Rust is installed with curl https://sh.rustup.rs | sh using the floating stable toolchain: deploy/debian-server/Dockerfile:24, desktop.yml:143-144, and rustup update stable in CI.
• These are reproducibility and supply-chain hygiene issues. Cargo and npm dependencies are locked (--locked, package-lock integrity, vendored rational-ordered-map tgz with sha512 at package-lock.json:1816). Node, PostgreSQL for Windows, WinSW, NSIS and pgmp downloads are SHA-256 pinned (Dockerfile:85-103, build.ps1:30-37, nsis.ps1:11-49, nix/pgmp.nix:21).

---

From the security review of 2026-11-06 (commit 6776c44), finding I-13: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Originally posted by: athanclark

PR [#531] pins every base image by digest except two: postgres:16-bookworm, to avoid a conflict with [#527] (it'll follow once [#527] merges), and archlinux:latest, which has no dated tag to pin to yet. This issue stays partly open for those two.