From 80cdac417a2ca235a2ea6244fd1f396808720645 Mon Sep 17 00:00:00 2001
From: "mendral-app[bot]" <233154221+mendral-app[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 23:07:13 -0800
Subject: [PATCH] Pin Dockerfile base image to digest for reproducibility

Pin ubuntu:24.04 to a specific SHA256 digest to ensure reproducible builds
and protect against supply chain attacks via floating tags.

The tag is kept alongside the digest for readability and to help with
future updates.
---
 Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 5386b759e..1b333418d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
-FROM ubuntu:24.04
+# ubuntu:24.04 - pinned to digest for reproducibility (2026-02-05)
+FROM ubuntu:24.04@sha256:cd1dba651b3080c3686ecf4e3c4220f026b521fb76978881737d24f200828b2b
 
 LABEL org.opencontainers.image.source="https://github.com/getprobo/probo"
 LABEL org.opencontainers.image.licenses="MIT"