News for hackers. Stuff that matters.

A comment on Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled. Parent comment

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by sterlind on Saturday April 27, 2019 @10:24AM (#19765684)
I do it! Everything I pull is pinned with sha256 since I use Nix/Kubenix, so I'm required to pin sha256 if I'm fetching from the Docker registry (or build the package deterministically myself.)
[ Parent | on HN ]
Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by cyphar on Wednesday May 01, 2019 @11:51AM (#19798242)
The way image signing works with Docker is that there is a signature tying a tag to a sha256. If you use the sha256 directly you get immutable sources, but now your source isn't signed anymore -- how are you sure the hash is correct?
[ Parent | on HN ]