rules:
- id: dockerfile-source-not-pinned
  patterns:
  - pattern-either:
    - patterns:
      - pattern: FROM $IMAGE:$VERSION@$HASH
      - metavariable-regex:
          metavariable: $HASH
          regex: (?!sha256:)
    - patterns:
      - pattern: FROM $IMAGE
      - pattern: FROM $IMAGE:$VERSION
      - pattern-not-inside: FROM $IMAGE:$VERSION@$HASH
  message: >- 
    To ensure reproducible builds, pin Dockerfile `FROM` commands to a specific
    hash. You can find the hash by running `docker pull $IMAGE` and then 
    specify it with `$IMAGE:$VERSION@sha256:<hash goes here>`
  languages:
  - dockerfile
  severity: INFO
  metadata:
    references:
    - https://stackoverflow.com/a/33511811/4965
    category: best-practice
    technology:
    - docker