ADD fetches a remote URL without verifying it

A Dockerfile ADD whose source is an http:// or https:// URL downloads a file at build time and writes it into the image, with nothing checking that what came back is what was expected. (Docker auto-extracts only local tar archives; a remote source is stored as-is, which is why the example below then has to run tar itself.)

The URL is usually a moving target — latest/agent.tar.gz — so the image content depends on whoever controls that host on the day of the build, and on nobody noticing if it changes. That is CWE-494, download of code without an integrity check, and it is why Docker’s own guidance is to prefer COPY for local paths and to verify anything fetched.

ADD --checksum=sha256:…​ is not reported: the checksum is the verification, and it is the reason the instruction gained the flag.

Reported:

Not reported:

State what you expect to receive. With a recent BuildKit, --checksum does it in place:

Otherwise fetch and verify in one RUN, so a mismatch fails the build:

Pin the URL to a version rather than latest, so the checksum stays meaningful. Better still, where the artifact is yours, vendor it into the build context and COPY it.