Summary

This PR updates every Dockerfile to use pinned image digests (e.g., debian:bookworm-slim@sha256:<digest>) instead of floating or tag-only references such as debian:bookworm-slim or ghcr.io/zaproxy/zaproxy:nightly. Unpinned base images pose a serious supply-chain security risk because upstream tags can be modified, overwritten, compromised, or drift over time. By pinning images to immutable digests, we ensure that the container build always uses the exact intended base layer, improving both security and reproducibility.

Fault/Vulnerability

Upstream Image Drift

Docker tags such as FROM debian:bookworm-slim and FROM ghcr.io/zaproxy/zaproxy:nightly are mutable references. The content of these tags can change at any time. This creates several vulnerabilities:

1. Silent updates may introduce breaking changes or vulnerabilities.
2. Compromised upstream registries could inject malware into official tags.
3. Builds performed at different times produce inconsistent images.
4. Attackers may perform tag-pinning attacks, modifying remote images while keeping the tag unchanged.

Reproducibility Failure

Floating tags mean you cannot reproduce:

1. security scans
2. test results
3. SBOMs
4. deployment compliance reports
   This conflicts with modern supply-chain frameworks like SLSA, NIST SSDF, and CIS Docker Benchmark.

Elevation of Supply-Chain Risk

An attacker who compromises a registry, they can push a backdoored image with that tag, and then the builds would automatically use it. Relying on unverified upstream content increases exposure to:

1. malicious injection
2. accidental corruption
3. CVE regressions
4. dependency rollback risks

OWASP Violations

Use a Docker image digest instead of mutable tags

Changes Made

Dockerfile-stable, Dockerfile-weekly, and Dockerfile-live

Before:
'''shell
FROM --platform=linux/amd64 debian:bookworm-slim AS builder
...
FROM debian:bookworm-slim AS final

After:
```shell
FROM --platform=linux/amd64 debian:bookworm-slim@sha256:<digest> AS builder
...
FROM debian:bookworm-slim@sha256:<digest> AS final

Both builder and final stages now use pinned Debian digests, ensuring reproducible build results and prevent tag mutation attacks and accidental upstream development drift.

Dockerfile-bare

Before:

FROM --platform=linux/amd64 debian:bookworm-slim AS builder
...
FROM eclipse-temurin:17-jre-alpine AS final

After:

FROM --platform=linux/amd64 debian:bookworm-slim@sha256:<digest> AS builder
...
FROM eclipse-temurin:17-jre-alpine@sha256:<digest> AS final

By adding digest pinning to the Debian builder image and the runtime Alpine JRE image, the image is protected from JRE tag changes, which can occur frequently.

Dockerfile-tests

Before:

FROM --platform=linux/amd64 debian:bookworm-slim AS builder
...
FROM ghcr.io/zaproxy/zaproxy:nightly

After:

FROM --platform=linux/amd64 debian:bookworm-slim@sha256:<digest> AS builder
...
FROM ghcr.io/zaproxy/zaproxy:nightly@sha256:<digest>

Both the Debian build stage and the ZAP nighly base image are now digest-pinned. Nightly builds are particularly mutable, so digest pinning prevents accidentally pulling different nightly builds, registry rollback attacks, and potentially malicious overwrite of the nightly tag.

How the Fix Works

Image digests operate like cryptographic fingerprints:

1. They uniquely identify a specific image version
2. They cannot change, even if tags move
3. Docker will refuse to pull an image if the digest does not match

This ensures:

1. Build Integrity - Every rebuild uses exactly the same upstream root filesystem.
2. Supply Chain Protection - Even if:
   a. The registry is compromised
   b. A tag is overwritten
   c. An upstream maintainer publishes a bad release
   Your builds remain safe because they only accept the specific approved digest.

Security Impact

Eliminates entire classes of tag-based supply-chain attacks

Tag-based supply chain attacks such as:

1. tag mutation
2. tag rollback
3. compromised maintainers
4. malicious mirror injection
5. registry poisoning
   cannot happen with immutable digests. Also, pinned digests ensure dependencies are upgraded intentionally. This means more diligence and manual upgrades, but that prevents automation attack-vectors.