Skip to content

REG-PIN-01: Deployment references immutable content

Property Value
Severity medium
Platform Image registry
Lifecycle stage supply
Evaluated from Evidence sent to the service (collector bundles or registry scans), not from a cloud API scan.

How to fix

  • Deploy by digest (image@sha256:…), not by a mutable tag, so a push to the tag cannot change what runs.

After the fix, scan again: the check should report PASS.

  • Runtime detection DET-R1 (Image registry): Watched tag moved to new content
  • Runtime detection DET-R3 (Image registry): Tag immutability turned off

Generated from untrust 1.3.0 (commit 7ef462d9a0c3).