The Dockerfile at HEAD pinned LIBEST_REF=v3.2.0-2 — that ref does
NOT exist on cisco/libest upstream. Verified via:
curl -sS https://api.github.com/repos/cisco/libest/tags
# only tags returned: v1.0.0, r3.2.0, 1.1.0
The 'v' prefix and the '-2' patch suffix were both wrong from day
one (commit e9011ca, EST RFC 7030 hardening Phase 10.1). The bug
went undetected because the libest sidecar Dockerfile was never
built end-to-end — neither operator-side nor in CI. The Dockerfile's
own header comment ('last tag 3.2.0-2 from 2018') was inaccurate
in the same way.
This fix:
- ARG LIBEST_REF=v3.2.0-2 → r3.2.0 (the actual upstream tag, sha
4ca02c6d7540f2b1bcea278a4fbe373daac7103b verified via
api.github.com/repos/cisco/libest/git/refs/tags/r3.2.0)
- Updated the surrounding head-comment block to reflect the real
upstream tag name + cite the 2026-04-30 GitHub API verification.
- Added a note explaining the prior broken pin so future readers
don't re-introduce it.
The estclient binary built from r3.2.0 supports the only RFC 7030
endpoint the est_e2e_test.go exercises ('estclient -g' = GET
cacerts), so the integration test still works against this ref.
Closes the libest-build-failure surfaced by ci-pipeline-cleanup
Phase 8's Docker build smoke step (CI run 25192163943, job
'image-and-supply-chain').
CI's 'Forbidden bare FROM regression guard (H-001)' rejects any
Dockerfile FROM line missing an @sha256:... digest pin. The Phase 10
libest sidecar Dockerfile shipped two bare FROMs at lines 25 and 55,
both targeting debian:bookworm-slim. The repo's Bundle A / Audit
H-001 (CWE-829) policy has been in force on every other Dockerfile
since the bundle landed; the new sidecar simply needs to follow the
same convention.
Pinned both lines to:
debian:bookworm-slim@sha256:f9c6a2fd2ddbc23e336b6257a5245e31f996953ef06cd13a59fa0a1df2d5c252
That's the OCI image-index digest from
https://hub.docker.com/v2/repositories/library/debian/tags/bookworm-slim
fetched 2026-04-29 (last_pushed 2026-04-22). Multi-arch index, so
Docker resolves the per-arch manifest correctly on the CI runner.
Added a comment at the top of the FROM block documenting the bump
procedure (curl + jq one-liner against the Docker Hub registry API),
matching the convention from the top-level Dockerfile.
Verified locally with the exact CI guard regex
(grep -HnE '^FROM\s+[^@#]+(\s+AS\s+\S+)?\s*$' across every
Dockerfile* under the repo, excluding web/node_modules) — passes.
Also verified the M-012 USER-drop guard still passes for the libest
sidecar (terminal USER estuser, set on line 73).
