From bf1350a8600517144b2dd5c3fd570939bf71303b Mon Sep 17 00:00:00 2001
From: Julio <julio.gonzalez@datadoghq.com>
Date: Thu, 27 Aug 2026 15:35:45 +0200
Subject: [PATCH] chore: add integrity checks

---
 .gitlab/fuzz.yml               |  6 +++++-
 tools/docker/Dockerfile.centos | 11 ++++++++---
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.gitlab/fuzz.yml b/.gitlab/fuzz.yml
index 10a919d925..1b32483401 100644
--- a/.gitlab/fuzz.yml
+++ b/.gitlab/fuzz.yml
@@ -21,7 +21,11 @@ fuzz:
       allow_failure: true
   timeout: 1h
   script:
-    - VAULT_VERSION=1.15.4 && curl -fsSL "https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" -o vault.zip && unzip vault.zip && mv vault /usr/local/bin/vault && rm vault.zip && chmod +x /usr/local/bin/vault
+    - VAULT_VERSION=1.15.4
+    - VAULT_SHA256=f42f550713e87cceef2f29a4e2b754491697475e3d26c0c5616314e40edd8e1b
+    - curl -fsSL --retry 3 "https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" -o vault.zip
+    - echo "${VAULT_SHA256}  vault.zip" | sha256sum -c -
+    - unzip vault.zip && mv vault /usr/local/bin/vault && rm vault.zip && chmod +x /usr/local/bin/vault
     - NIGHTLY_VERSION=$(awk -F'"' '/^channel[[:space:]]*=/ {print $2}' nightly-toolchain.toml)
     - rustup default "$NIGHTLY_VERSION"
     - cargo +"$NIGHTLY_VERSION" install cargo-fuzz --locked
diff --git a/tools/docker/Dockerfile.centos b/tools/docker/Dockerfile.centos
index 5a350a6eef..dae341927e 100644
--- a/tools/docker/Dockerfile.centos
+++ b/tools/docker/Dockerfile.centos
@@ -1,4 +1,4 @@
-FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main-centos
+FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main-centos@sha256:92e34415f6c4d771ab5797ce62cb658a2134737a02b609238697f7fc6279770e
 
 RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
     && sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo \
@@ -17,5 +17,10 @@ RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
 
 ENV PATH="/opt/rh/devtoolset-11/root/usr/bin:$PATH"
 
-# use the musl binary for nextest since glibc isn't new enough on CentOS7 for nextest
-RUN curl -LsSf https://get.nexte.st/0.9.96/linux-musl | tar zxf - -C /usr/local/bin
+ARG NEXTEST_VERSION=0.9.96
+ARG NEXTEST_SHA256=34589b4debb468d84f6ab81652b7bc42ac672162a3dfc8063abe6fd850898150
+RUN curl -fsSL --retry 3 -o /tmp/nextest.tar.gz \
+      "https://github.com/nextest-rs/nextest/releases/download/cargo-nextest-${NEXTEST_VERSION}/cargo-nextest-${NEXTEST_VERSION}-x86_64-unknown-linux-musl.tar.gz" \
+    && echo "${NEXTEST_SHA256}  /tmp/nextest.tar.gz" | sha256sum -c - \
+    && tar zxf /tmp/nextest.tar.gz -C /usr/local/bin \
+    && rm /tmp/nextest.tar.gz