From 9281c7e48405e8db94194f33af9e3bce60840929 Mon Sep 17 00:00:00 2001 From: salmonik Date: Wed, 4 Nov 2026 01:32:40 +0100 Subject: docker: pin and verify a week-old yt-dlp release --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index de77d6a..a3da394 100644 --- a/README.md +++ b/README.md @@ -111,8 +111,9 @@ Notes: - If the build fails to resolve `crates.io` or `deb.debian.org`, run `docker buildx build --load --network=host -t senator-sperma:latest .`; `compose.yaml` already sets `network: host` for builds on this host. -- yt-dlp is fetched from the latest upstream release at image build time. - Rebuild with `--no-cache` (`docker compose build --no-cache`) to refresh it. +- yt-dlp is pinned to a specific upstream release and verified against the + release checksum at image build time. Bump `YTDLP_VERSION` in the Dockerfile + to update it; pick a release that is at least a week old. ## Commands -- cgit v1.2.3