Replacing ADD by download and checking nginx-keyring.gpg

Fixing CIS-DI-0009 (See https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#cis-di-0009)

Author: waja

Dockerfile

@@ -46,9 +46,15 @@ RUN \
 ARG FROM
 FROM ${FROM} AS main
 
+ARG NGINX_KEYRING_SHA256_SUM=7d3d5a7adf37e17d6882e2f6f55324b9a8f978ef3c99c50fe801af67c9847c91
 COPY docker/unit.list /etc/apt/sources.list.d/unit.list
-ADD --chmod=444 --chown=0:0 https://unit.nginx.org/keys/nginx-keyring.gpg /usr/share/keyrings/nginx-keyring.gpg
 RUN export DEBIAN_FRONTEND=noninteractive \
+    && curl -fsSL https://unit.nginx.org/keys/nginx-keyring.gpg -o /usr/share/keyrings/nginx-keyring.gpg \
+    && echo "Verifying integrity of nginx-keyring.gpg ..." \
+    && echo "${NGINX_KEYRING_SHA256_SUM}  /usr/share/keyrings/nginx-keyring.gpg" | sha256sum -c -\
+    || (echo "Error: checksum verification of nginx-keyring.gpg failed!" && exit 1) \
+    && chmod 444 /usr/share/keyrings/nginx-keyring.gpg \
+    && chown 0:0 /usr/share/keyrings/nginx-keyring.gpg \
     && apt-get update -qq \
     && apt-get upgrade \
       --yes -qq --no-install-recommends \