Pin expected commit when building Leiningen from source

resources/templates/lein.tmpl

@@ -4,8 +4,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 {% for dep in install-deps %}{{dep}} && \
 {% endfor %}export GNUPGHOME="$(mktemp -d)" && \
@@ -15,6 +15,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys {{gpg-key}} && \
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "{{lein-commit}}" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

src/docker_clojure/dockerfile/lein.clj

@@ -30,10 +30,24 @@
 ;; Leiningen release tags are signed with this key (Phil Hagelberg).
 (def ^:const signing-key "9D13D9426A0814B3373CF5E3D8A8243577A7859F")
 
+;; The commit each release tag is expected to point at. After cloning we assert
+;; HEAD matches, so a moved or re-pointed upstream tag can't slip a different
+;; commit past us (belt-and-suspenders with `git verify-tag`). Requested by the
+;; docker-library/official-images maintainers.
+(def release-commits
+  {"2.13.0" "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030"})
+
+(defn release-commit [version]
+  (or (get release-commits version)
+      (throw (ex-info (str "No known Git commit for Leiningen " version
+                           "; add it to lein/release-commits before building.")
+                      {:lein-version version}))))
+
 (defn install [_installer-hashes {:keys [build-tool-version] :as variant}]
   (render-template
    "templates/lein.tmpl"
    {:lein-version    build-tool-version
+    :lein-commit     (release-commit build-tool-version)
     :clojure-version bundled-clojure-version
     :gpg-key         signing-key
     :install-deps    (install-deps variant)

target/debian-bookworm-11/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-17/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-21/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-25/latest/Dockerfile

@@ -12,8 +12,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -25,6 +25,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-25/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-26/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-slim-11/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-slim-17/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-slim-21/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-slim-25/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bookworm-slim-26/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bullseye-11/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bullseye-17/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bullseye-21/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bullseye-25/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \

target/debian-bullseye-26/lein/Dockerfile

@@ -10,8 +10,8 @@ ENV LEIN_INSTALL=/usr/local/bin/
 WORKDIR /tmp
 
 # No standalone uberjar is published for this version, so build it from source.
-# Verify Leiningen's GPG-signed release tag, then bootstrap leiningen-core's
-# dependencies with Maven and run `lein uberjar`.
+# Verify Leiningen's GPG-signed release tag and pin the expected commit, then
+# bootstrap leiningen-core's dependencies with Maven and run `lein uberjar`.
 RUN set -eux; \
 apt-get update && \
 apt-get install -y make maven git gnupg && \
@@ -23,6 +23,7 @@ gpg --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 9D13D9426A0814B3
 git clone --depth 1 --branch $LEIN_VERSION https://codeberg.org/leiningen/leiningen.git && \
 cd leiningen && \
 git verify-tag $LEIN_VERSION && \
+[ "$(git rev-parse HEAD)" = "d703e4802feb3e5c3fa9ae9f1874fb7a3a3e3030" ] && \
 ( cd leiningen-core && mvn -B -q -DskipTests install && mvn -B -q dependency:build-classpath -Dmdep.outputFile=.lein-bootstrap ) && \
 bin/lein uberjar && \
 install -m 0644 target/leiningen-$LEIN_VERSION-standalone.jar /usr/share/java/leiningen-$LEIN_VERSION-standalone.jar && \