fix(containers): repin golang:1.27-alpine to a live digest

arcane/home/honeypot-cisco-asa-honeypot/cisco-asa-honeypot/Dockerfile

@@ -1,7 +1,7 @@
 # Cisco ASA WebVPN + IKE decoy (CVE-2018-0101), Go port of
 # t3chn0m4g3/ciscoasa_honeypot (#238, #414) -- see main.go/ike.go's own
 # doc comments for the real (not vendored-as-is) behavior this reproduces.
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go ./

arcane/home/honeypot-citrix-honeypot/citrix-honeypot/Dockerfile

@@ -1,6 +1,6 @@
 # Citrix ADC/NetScaler Gateway decoy (CVE-2019-19781), Go port of
 # t3chn0m4g3/CitrixHoneypot (#238, #414) -- see main.go's own doc comment.
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go ./

arcane/home/honeypot-dicompot/dicompot/Dockerfile

@@ -20,7 +20,7 @@
 # pin itself lives in go.mod/go.sum (committed, like every other Go
 # sensor's), not as a rebuild-time ARG -- that's what lets CI's `go test`
 # and `go build` run against the exact same resolved deps this image builds.
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download

arcane/home/honeypot-dionaea/tftp-relay/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod main.go ./
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /tftp-relay .

arcane/home/honeypot-dnp3/dnp3-honeypot/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go .

arcane/home/honeypot-dns-honeypot/dns-honeypot/Dockerfile

@@ -8,7 +8,7 @@
 # length -- a UDP reflector that never returns more bytes than it received
 # cannot be an amplification vector, by definition, independent of any
 # particular request/response shape.
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go ./

arcane/home/honeypot-endlessh/endlessh-honeypot/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go .

arcane/home/honeypot-http/http-honeypot/Dockerfile

@@ -1,5 +1,5 @@
 # Static Go binary in a scratch image (~8 MB, no shell/libc).
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go .

arcane/home/honeypot-multipot/multipot/Dockerfile

@@ -1,5 +1,5 @@
 # Static Go binary in a scratch image (~8 MB, no shell/libc).
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go .

arcane/home/honeypot-rdp-honeypot/rdp-honeypot/Dockerfile

@@ -2,7 +2,7 @@
 # #412) -- see main.go's own doc comment for why this is genuinely simple
 # despite RDP's reputation, and why that reverses #238's original "vendor,
 # don't port" call.
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go ./

arcane/home/honeypot-sonicwall-sma/sonicwall-sma-honeypot/Dockerfile

@@ -1,6 +1,6 @@
 # SonicWall SMA1000 Work Place/AMC decoy for the CVE-2026-83548/83549
 # SSRF+RCE chain (#3033) -- see main.go's own doc comment.
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY *.go ./

arcane/home/honeypot-utilities/reporter/Dockerfile

@@ -1,7 +1,7 @@
 # Static Go binary in a scratch image, same pattern as multipot/http-honeypot.
 # modernc.org/sqlite is pure Go (no cgo), so CGO_ENABLED=0 still holds despite
 # the SQLite dependency -- see dedup.go's import comment.
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod go.sum .
 RUN go mod download

portbridge/Dockerfile

@@ -1,5 +1,5 @@
 # Static Go binary in a scratch image (~5 MB).
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 COPY main.go .

vps/portbridge/Dockerfile

@@ -1,5 +1,5 @@
 # Static Go binary in a scratch image (~5 MB).
-FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build
+FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build
 WORKDIR /src
 COPY go.mod .
 # Every non-test .go file, not a hand-maintained list. The enumerated form