docker: pin and verify a week-old yt-dlp release

1 files changed, 10 insertions, 4 deletions

diff --git a/Dockerfile b/Dockerfile
index 9a79752..7987f85 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -60,10 +60,16 @@ RUN apt-get update \
         tzdata \
     && rm -rf /var/lib/apt/lists/*
 
-# yt-dlp is distributed as a self-contained Python zipapp; using the latest
-# release avoids the stale Debian package breaking on YouTube changes.
-ADD https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp /usr/local/bin/yt-dlp
-RUN chmod 755 /usr/local/bin/yt-dlp
+# yt-dlp is distributed as a self-contained Python zipapp. Pin a release that
+# is at least a week old (and verify its checksum) so a compromised or broken
+# upstream release cannot silently enter the image.
+ARG YTDLP_VERSION=2026.10.26
+ADD https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_VERSION}/yt-dlp /usr/local/bin/yt-dlp
+ADD https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_VERSION}/SHA2-256SUMS /tmp/yt-dlp-sums
+RUN cd /usr/local/bin \
+    && grep ' yt-dlp$' /tmp/yt-dlp-sums | sha256sum -c - \
+    && chmod 755 yt-dlp \
+    && rm /tmp/yt-dlp-sums
 
 RUN useradd --create-home --uid 1000 --shell /usr/sbin/nologin bot \
     && mkdir -p /app/data /app/piper /tmp/senator_sperma \