container-source-policy-darwin-x64 0.3.1 → 0.5.0

package/README.md

@@ -1,8 +1,12 @@
 # container-source-policy
 
-Generate a Docker BuildKit **source policy** file by parsing Dockerfiles and pinning `FROM` images to immutable digests.
+[![codecov](https://codecov.io/gh/tinovyatkin/container-source-policy/graph/badge.svg?token=tSSxWyOmP2)](https://codecov.io/gh/tinovyatkin/container-source-policy)
 
-This helps make `docker buildx build` inputs reproducible without rewriting your Dockerfile.
+Generate BuildKit **source policies** that make Docker builds reproducible and secure — without modifying your Dockerfiles.
+
+- 📌 **Pin** images and URLs to immutable checksums
+- 🛡️ **Harden** builds with [Docker Hardened Images](https://dhi.io) (fewer CVEs, smaller footprint)
+- ✅ **Validate** existing policies against Dockerfiles *(coming soon)*
 
 See the [BuildKit documentation on build reproducibility](https://github.com/moby/buildkit/blob/master/docs/build-repro.md) for more details on source policies.
 
@@ -67,22 +71,45 @@ Write directly to a file:
 container-source-policy pin --output source-policy.json Dockerfile
 ```
 
-Then pass the policy to BuildKit / Buildx via the environment variable:
+### Docker Hardened Images (DHI)
+
+Use `--prefer-dhi` to pin Docker Hub library images to their [Docker Hardened Images](https://www.docker.com/blog/docker-hardened-images-now-free/) equivalents when available:
 
 ```bash
-EXPERIMENTAL_BUILDKIT_SOURCE_POLICY=source-policy.json docker buildx build .
+# First, login to dhi.io with your Docker Hub credentials
+docker login dhi.io
+
+# Then use --prefer-dhi to prefer hardened images
+container-source-policy pin --prefer-dhi --stdout Dockerfile
 ```
 
-Or use `buildctl` directly with the `--source-policy-file` flag:
+This converts eligible images (e.g., `alpine:3.21`, `node:22`, `golang:1.23`) to their `dhi.io` equivalents, which are minimal, security-hardened
+versions with fewer vulnerabilities.
+
+- Only Docker Hub library images (`alpine`, `node`, `golang`, etc.) are eligible
+- Images not available on dhi.io silently fall back to docker.io
+- Non-library images (`ghcr.io/*`, `docker.io/myorg/*`) are unchanged
+- The policy selector still matches the original reference, so your Dockerfile works unchanged
+
+Example output with `--prefer-dhi`:
+
+```json
+{
+  "selector": { "identifier": "docker-image://golang:1.23" },
+  "updates": { "identifier": "docker-image://dhi.io/golang:1.23@sha256:..." }
+}
+```
+
+Then pass the policy to BuildKit / Buildx via the environment variable:
 
 ```bash
-buildctl build --frontend dockerfile.v0 --local dockerfile=. --local context=. --source-policy-file source-policy.json
+EXPERIMENTAL_BUILDKIT_SOURCE_POLICY=source-policy.json docker buildx build .
 ```
 
-Shell completion scripts are available via Cobra:
+Or use `buildctl` directly with the `--source-policy-file` flag:
 
 ```bash
-container-source-policy completion zsh
+buildctl build --frontend dockerfile.v0 --local dockerfile=. --local context=. --source-policy-file source-policy.json
 ```
 
 ## What gets pinned
@@ -108,9 +135,11 @@ container-source-policy completion zsh
   - Git URLs (handled separately, see below)
   - Volatile content (emits warning): URLs returning `Cache-Control: no-store`, `no-cache`, `max-age=0`, or expired `Expires` headers
 - Fetches the checksum and emits `CONVERT` rules with `http.checksum` attribute.
-- **Respects `Vary` header**: captures request headers that affect response content (e.g., `User-Agent`, `Accept-Encoding`) and includes them in the policy as `http.header.*` attributes to ensure reproducible builds.
+- **Respects `Vary` header**: captures request headers that affect response content (e.g., `User-Agent`, `Accept-Encoding`) and includes them in the
+  policy as `http.header.*` attributes to ensure reproducible builds.
 
 **Optimized checksum fetching** — avoids downloading large files when possible:
+
 - `raw.githubusercontent.com`: extracts SHA256 from ETag header
 - GitHub releases: uses the API `digest` field (set `GITHUB_TOKEN` for higher rate limits)
 - S3: uses `x-amz-checksum-sha256` response header (by sending `x-amz-checksum-mode: ENABLED`)
@@ -146,9 +175,10 @@ UPDATE_SNAPS=true go test ./internal/integration/...
 
 ## Repository layout
 
-- `cmd/container-source-policy/cmd/`: Cobra CLI commands
+- `cmd/container-source-policy/cmd/`: CLI commands (urfave/cli)
 - `internal/dockerfile`: Dockerfile parsing (`FROM` and `ADD` extraction)
 - `internal/registry`: registry client (image digest resolution)
+- `internal/dhi`: Docker Hardened Images reference mapping
 - `internal/http`: HTTP client (URL checksum fetching with optimizations)
 - `internal/git`: Git client (commit SHA resolution via git ls-remote)
 - `internal/policy`: BuildKit source policy types and JSON output

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "container-source-policy-darwin-x64",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "The darwin x64 binary for container-source-policy",
   "repository": {
     "type": "git",