docker: pin and verify a week-old yt-dlp release

2 files changed, 13 insertions, 6 deletions

diff --git a/Dockerfile b/Dockerfile
index 9a79752..7987f85 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -60,10 +60,16 @@ RUN apt-get update \
         tzdata \
     && rm -rf /var/lib/apt/lists/*
 
-# yt-dlp is distributed as a self-contained Python zipapp; using the latest
-# release avoids the stale Debian package breaking on YouTube changes.
-ADD https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp /usr/local/bin/yt-dlp
-RUN chmod 755 /usr/local/bin/yt-dlp
+# yt-dlp is distributed as a self-contained Python zipapp. Pin a release that
+# is at least a week old (and verify its checksum) so a compromised or broken
+# upstream release cannot silently enter the image.
+ARG YTDLP_VERSION=2026.10.26
+ADD https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_VERSION}/yt-dlp /usr/local/bin/yt-dlp
+ADD https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_VERSION}/SHA2-256SUMS /tmp/yt-dlp-sums
+RUN cd /usr/local/bin \
+    && grep ' yt-dlp$' /tmp/yt-dlp-sums | sha256sum -c - \
+    && chmod 755 yt-dlp \
+    && rm /tmp/yt-dlp-sums
 
 RUN useradd --create-home --uid 1000 --shell /usr/sbin/nologin bot \
     && mkdir -p /app/data /app/piper /tmp/senator_sperma \
diff --git a/README.md b/README.md
index de77d6a..a3da394 100644
--- a/README.md
+++ b/README.md
@@ -111,8 +111,9 @@ Notes:
 - If the build fails to resolve `crates.io` or `deb.debian.org`, run
   `docker buildx build --load --network=host -t senator-sperma:latest .`;
   `compose.yaml` already sets `network: host` for builds on this host.
-- yt-dlp is fetched from the latest upstream release at image build time.
-  Rebuild with `--no-cache` (`docker compose build --no-cache`) to refresh it.
+- yt-dlp is pinned to a specific upstream release and verified against the
+  release checksum at image build time. Bump `YTDLP_VERSION` in the Dockerfile
+  to update it; pick a release that is at least a week old.
 
 ## Commands