moved the final label to the very bottom, since they will always change

dockerfile

@@ -2,27 +2,31 @@
 #
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
-FROM debian:stable-slim
+FROM debian:bullseye-slim
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG GIT_COMMIT
 ARG VERSION
 ARG TIMESTAMP
 LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later" \
-org.opencontainers.image.base.name="docker.io/debian:stable-slim" \
+org.opencontainers.image.base.name="docker.io/debian:bullseye-slim" \
 org.opencontainers.image.title=buildimage \
 org.opencontainers.image.source="https://git.schmidl.dev/schtobia/buildimage" \
 org.opencontainers.image.url="https://git.schmidl.dev/schtobia/buildimage"
 
-LABEL org.opencontainers.image.revision=${GIT_COMMIT}
-LABEL org.opencontainers.image.version=${VERSION}
-LABEL org.opencontainers.image.created=${TIMESTAMP}
-
 RUN apt update \
  && apt install --assume-yes --no-install-recommends \
         build-essential \
+        dpkg-sig \
         git \
  && find /var/lib/apt -type f -delete
 
-VOLUME /workdir
+RUN useradd -rm builder
+
+USER builder
+
 WORKDIR /workdir
+
+LABEL org.opencontainers.image.revision=${GIT_COMMIT}
+LABEL org.opencontainers.image.version=${VERSION}
+LABEL org.opencontainers.image.created=${TIMESTAMP}