From 1ec556238e08d377093d4445aebb5be42637abea Mon Sep 17 00:00:00 2001
From: "W. Felix Handte" <w@felixhandte.com>
Date: Thu, 9 Mar 2023 12:54:07 -0500
Subject: [PATCH 1/2] Pin Moar Action Dependencies

An offering to the Scorecard gods, may they have mercy on our souls.
---
 .github/workflows/dev-long-tests.yml    | 2 +-
 .github/workflows/dev-short-tests.yml   | 8 ++++----
 .github/workflows/windows-artifacts.yml | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/dev-long-tests.yml b/.github/workflows/dev-long-tests.yml
index 5a776b597..8c8bea916 100644
--- a/.github/workflows/dev-long-tests.yml
+++ b/.github/workflows/dev-long-tests.yml
@@ -247,7 +247,7 @@ jobs:
         shell: msys2 {0}
     steps:
     - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
-    - uses: msys2/setup-msys2@v2
+    - uses: msys2/setup-msys2@5beef6d11f48bba68b9eb503e3adc60b23c0cc36 # tag=v2
       with:
         msystem: MINGW64
         install: make
diff --git a/.github/workflows/dev-short-tests.yml b/.github/workflows/dev-short-tests.yml
index 64616380d..6cb9c5ba7 100644
--- a/.github/workflows/dev-short-tests.yml
+++ b/.github/workflows/dev-short-tests.yml
@@ -274,7 +274,7 @@ jobs:
     steps:
     - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
     - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1.3
+      uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # tag=v1.3
     - name: Build
       working-directory: ${{env.GITHUB_WORKSPACE}}
       run: |
@@ -301,7 +301,7 @@ jobs:
     steps:
     - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
     - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1.3
+      uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # tag=v1.3
     - name: Build ${{matrix.name}}
       working-directory: ${{env.GITHUB_WORKSPACE}}
       # See https://docs.microsoft.com/visualstudio/msbuild/msbuild-command-line-reference
@@ -444,7 +444,7 @@ jobs:
         shell: msys2 {0}
     steps:
     - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
-    - uses: msys2/setup-msys2@v2
+    - uses: msys2/setup-msys2@5beef6d11f48bba68b9eb503e3adc60b23c0cc36 # tag=v2
       with:
         msystem: ${{ matrix.msystem }}
         install: make diffutils
@@ -481,7 +481,7 @@ jobs:
     steps:
     - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
     - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1.3
+      uses: microsoft/setup-msbuild@1ff57057b5cfdc39105cd07a01d78e9b0ea0c14c # tag=v1.3
     - name: Build and run tests
       working-directory: ${{env.GITHUB_WORKSPACE}}
       env:
diff --git a/.github/workflows/windows-artifacts.yml b/.github/workflows/windows-artifacts.yml
index 0620c42c1..b66de904e 100644
--- a/.github/workflows/windows-artifacts.yml
+++ b/.github/workflows/windows-artifacts.yml
@@ -15,7 +15,7 @@ jobs:
         shell: msys2 {0}
     steps:
     - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # tag=v3
-    - uses: msys2/setup-msys2@v2
+    - uses: msys2/setup-msys2@5beef6d11f48bba68b9eb503e3adc60b23c0cc36 # tag=v2
       with:
         msystem: MINGW64
         install: make zlib git p7zip mingw-w64-x86_64-gcc
@@ -42,7 +42,7 @@ jobs:
         cd ..
 
     - name: Publish zstd-win-release-win64.zip
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # tag=v3
       with:
         path: ${{ github.workspace }}/bin/zstd-win-release-win64.zip
         name: zstd-win-release-win64.zip

From cd9486031dcb1cab5143d2c0c6edc34127d97a69 Mon Sep 17 00:00:00 2001
From: "W. Felix Handte" <w@felixhandte.com>
Date: Thu, 9 Mar 2023 17:01:22 -0500
Subject: [PATCH 2/2] Also Pin Dockerfile Dependency Hashes

---
 .circleci/images/primary/Dockerfile | 2 +-
 contrib/docker/Dockerfile           | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.circleci/images/primary/Dockerfile b/.circleci/images/primary/Dockerfile
index bfcb6af69..4b77032b6 100644
--- a/.circleci/images/primary/Dockerfile
+++ b/.circleci/images/primary/Dockerfile
@@ -1,4 +1,4 @@
-FROM circleci/buildpack-deps:focal
+FROM circleci/buildpack-deps@sha256:f6f10c11b7b8ccfd4f4a5b830c3256803604ce61292b60cb22e26b12f62b0e8c
 
 RUN sudo dpkg --add-architecture i386
 RUN sudo apt-get -y -qq update
diff --git a/contrib/docker/Dockerfile b/contrib/docker/Dockerfile
index e06a32c0d..912bf1949 100644
--- a/contrib/docker/Dockerfile
+++ b/contrib/docker/Dockerfile
@@ -1,13 +1,13 @@
 # Dockerfile
 # First image to build the binary
-FROM alpine as builder
+FROM alpine@sha256:69665d02cb32192e52e07644d76bc6f25abeb5410edc1c7a81a10ba3f0efb90a as builder
 
 RUN apk --no-cache add make gcc libc-dev
 COPY . /src
 RUN mkdir /pkg && cd /src && make && make DESTDIR=/pkg install
 
 # Second minimal image to only keep the built binary
-FROM alpine
+FROM alpine@sha256:69665d02cb32192e52e07644d76bc6f25abeb5410edc1c7a81a10ba3f0efb90a
 
 # Copy the built files
 COPY --from=builder /pkg /