Version Pinning

Go up to Terms and Definitions

Version Pinning selects and records an exact version or revision of an input for use by a defined build, deployment, assessment, or operational process.

The selected value may identify a source revision, software package version, container image digest, machine-image identifier, compliance benchmark release, tool version, plugin version, or other controlled input.

Version Pinning prevents an execution from silently selecting a later or otherwise different input when the original input remains required.

Within Crucible, Version Pinning supports Reproducibility, Provenance, and Traceability by connecting each result to the exact revisions used to produce it.

selection and recording of an exact version or revision of an input for use by a defined process

Generalized from software configuration management, dependency management, package management, and reproducible-build usage and specialized for the Crucible architecture and operational model.

A symbolic label, branch name, or unqualified latest-version reference does not provide reliable Version Pinning when the referenced content can change without changing the reference.

Version Pinning identifies the selected input. It does not by itself verify the integrity, authenticity, compatibility, or suitability of that input.

A Crucible Description identifies a repository tag, and the pull process resolves the tag to an exact Git commit. The recorded commit identifier pins the repository content used by the build.