Manage build pinning for Chainguard Libraries

Wed, 19 Aug 2026 08:04:00 +0000

Chainguard Libraries can serve a package version as either a Chainguard-built artifact or an upstream artifact that is scanned and proxied through Chainguard. Chainguard-built artifacts may have different checksums for the same version of the upstream artifact. If your lockfile records an upstream checksum and Chainguard later builds that package, your package manager can fail with integrity errors upon dependency resolution.

Build pinning keeps library artifacts stable when Chainguard publishes a new build of a package version you previously pulled from the scanned upstream fallback. Chainguard-built artifacts are always the default and take priority when available. Pinning only affects the exact package version already pinned. When enabled, Chainguard remembers which upstream versions your organization pulled and continues serving those specific versions even if a new Chainguard build is available, until you remove the pin. Moving to a different version of the package is unaffected; since that version was never pinned, it resolves fresh and Chainguard’s build is served by default.

Build Pinning on

Manage build pinning for Chainguard Libraries