repro_build_env_declared grants PASS on unpinned floating Docker images (:latest)

[Jaydeep869]

Description

repro_build_env_declared gives a green PASS with high confidence (0.85) simply because a Dockerfile exists, even if the Dockerfile uses unpinned floating base images (FROM alpine:latest) and unversioned package installations (apk add git). While #416 lists digest verification as a planned signal, the current check gives a false sense of reproducibility today.

What We Did

1. Audited a repository containing a Dockerfile with:

   FROM alpine:latest
   RUN apk update && apk add git openssh go python3

2. Ran darnit audit . --framework reproducibility --show-all.

What It Was Supposed To Do

Because floating tags like :latest pull different OS versions and packages over time, the check should not give an unqualified PASS without verifying whether the base image or package versions are pinned.

What We Got

The check awarded a confident pass:

✓ RE-01.02: PASS - Build environment declared via: Dockerfile (Docker) [confidence: 0.85]

Proposed Fix

When a Dockerfile is found, parse the FROM instruction:

• Base image pinned to @sha256:...: PASS (confidence 0.90)
• Base image pinned to release tag (e.g. :3.20): PASS (confidence 0.70)
• Base image using :latest or unpinned tag: WARN ("Dockerfile found but base image uses unpinned/floating tag")

Reference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/README.md#issue-4-false-sense-of-security-repro_build_env_declared-grants-pass-on-unpinned-floating-docker-images