1324413 - .taskcluster.yml should reference docker image by hash

Status: RESOLVED FIXED

Description

[Jonas Finnemann Jensen (:jonasfj)]

For added security and to avoid whitelists when validating COT artifacts later.

Comment 1

[Jonas Finnemann Jensen (:jonasfj)]

Attachment: Bug 1324413 - Lock image content hash for decision task;

This will make harder to falsify a decision task.
Notably our validation code only needs to verify that the definition of the
decision task as given here matches what is used in the task definition in
the Chain-Of-Trust artifact, in order to prove that the decision task is
a result of what ran in the tree.

Review commit: https://reviewboard.mozilla.org/r/99512/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/99512/

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8819871 [details]
Bug 1324413 - Lock image content hash for decision task;

https://reviewboard.mozilla.org/r/99512/#review99982

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4bd7d95379f6
Lock image content hash for decision task; r=dustin

Comment 4

[Wes Kocher (:KWierso)]

https://hg.mozilla.org/mozilla-central/rev/4bd7d95379f6