From 67d57fc40069a80057f4b39855d801ec32e5453e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ossi=20V=C3=A4=C3=A4n=C3=A4nen?=
 <4111915+oh6hay@users.noreply.github.com>
Date: Thu, 31 Mar 2022 15:22:20 +0300
Subject: [PATCH] Pin the FROM in dockerfiles (#19526)

This prevents supply chain attacks where the latest image is replaced with a malicious version.

Pinning done by using https://github.com/Jille/dockpin
---
 build/Dockerfile          | 2 +-
 build/Dockerfile.buildenv | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/build/Dockerfile b/build/Dockerfile
index 5f00ed60aa..a7fa98822c 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.14
+FROM alpine:3.14@sha256:635f0aa53d99017b38d1a0aa5b2082f7812b03e3cdb299103fe77b5c8a07f1d2
 
 # Some ENV variables
 ENV PATH="/mattermost/bin:${PATH}"
diff --git a/build/Dockerfile.buildenv b/build/Dockerfile.buildenv
index c98ca8a154..0210e0bbbc 100644
--- a/build/Dockerfile.buildenv
+++ b/build/Dockerfile.buildenv
@@ -1,3 +1,3 @@
-FROM golang:1.16.7
+FROM golang:1.16.7@sha256:0b5bf2d2c5682b0de7425b8a379330493bb8bbe984ebbcaf7ced1c0138640417
 
 RUN apt-get update && apt-get install -y make git apt-transport-https ca-certificates curl software-properties-common build-essential zip xmlsec1 jq