From 89dfc412f22c31558db0e40cac53604eae3686de Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 14 Oct 2026 20:15:52 +0200
Subject: [PATCH] Strip sha256 hash

---
 .gitea/workflows/deploy.yml | 6 ------
 install.sh                  | 4 +---
 render.sh                   | 2 --
 test.sh                     | 2 +-
 4 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index f0eb8cd..fbfe88a 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -4,9 +4,7 @@ on:
   pull_request:
 env:
   ARGOCD_CHART_VERSION: 10.7.2
-  ARGOCD_CHART_SHA256: 26111ae91779b28f18ef5c367f70530e3ecbec3effad45a7db59979344956dab
   HELM_VERSION: v4.2.2
-  HELM_SHA256: 9adafecab4d406853bba163a70e9f104f47dbbf65ce24b7653bae7e36150bcb6
   KUBECTL_VERSION: v1.36.3
   KUBERNETES_API: https://host.containers.internal:6443
   KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
@@ -19,7 +17,6 @@ jobs:
       - name: Install Helm
         run: |
           curl -fsSL -o "${RUNNER_TEMP}/helm.tgz" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          printf '%s  %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tgz" | sha256sum -c
           tar -xzf "${RUNNER_TEMP}/helm.tgz" -C "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
           echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
       - run: bash test.sh
@@ -32,11 +29,8 @@ jobs:
       - name: Install clients
         run: |
           curl -fsSL -o "${RUNNER_TEMP}/helm.tgz" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          printf '%s  %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tgz" | sha256sum -c
           tar -xzf "${RUNNER_TEMP}/helm.tgz" -C "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
           curl -fsSL -o "${RUNNER_TEMP}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-          curl -fsSL -o "${RUNNER_TEMP}/kubectl.sha256" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
-          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum -c
           chmod 0700 "${RUNNER_TEMP}/helm" "${RUNNER_TEMP}/kubectl"
           echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
       - name: Configure cluster
diff --git a/install.sh b/install.sh
index 67ac5fd..57ae861 100755
--- a/install.sh
+++ b/install.sh
@@ -3,10 +3,9 @@
 set -eu
 
 chart_version=10.7.2
-chart_sha256=26111ae91779b28f18ef5c367f70530e3ecbec3effad45a7db59979344956dab
 project_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 
-for command in helm kubectl openssl base64 curl sha256sum; do
+for command in helm kubectl openssl base64 curl; do
   if ! command -v "$command" >/dev/null 2>&1; then
     echo "Required command not found: $command" >&2
     exit 1
@@ -49,7 +48,6 @@ chart_archive=$(mktemp)
 trap 'rm -f "$chart_archive"' EXIT HUP INT TERM
 curl --fail --silent --show-error --location --output "$chart_archive" \
   "https://github.com/argoproj/argo-helm/releases/download/argo-cd-${chart_version}/argo-cd-${chart_version}.tgz"
-printf '%s  %s\n' "$chart_sha256" "$chart_archive" | sha256sum --check >&2
 
 helm upgrade --install argocd "$chart_archive" \
   --namespace argocd \
diff --git a/render.sh b/render.sh
index 9654e63..15355eb 100755
--- a/render.sh
+++ b/render.sh
@@ -2,12 +2,10 @@
 set -euo pipefail
 project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 version=${ARGOCD_CHART_VERSION:-10.7.2}
-digest=${ARGOCD_CHART_SHA256:-26111ae91779b28f18ef5c367f70530e3ecbec3effad45a7db59979344956dab}
 output=${1:?Usage: render.sh OUTPUT_FILE}
 chart=$(mktemp)
 trap 'rm -f "${chart}"' EXIT
 curl --fail --silent --show-error --location --output "${chart}" \
   "https://github.com/argoproj/argo-helm/releases/download/argo-cd-${version}/argo-cd-${version}.tgz"
-printf '%s  %s\n' "${digest}" "${chart}" | sha256sum --check >&2
 helm template argocd "${chart}" --namespace argocd \
   --values "${project_dir}/argocd-values.yaml" > "${output}"
diff --git a/test.sh b/test.sh
index 8c5c75f..d3844f2 100755
--- a/test.sh
+++ b/test.sh
@@ -8,7 +8,7 @@ bash -n "${project_dir}/render.sh" "${project_dir}/create-ci-kubeconfig.sh" "${p
 if grep -Eq '^kind: Secret$' "${workdir}/argocd.yaml"; then
   echo "Rendered Argo CD state must not contain Secrets" >&2; exit 1
 fi
-image=ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
+image=ghcr.io/yannh/kubeconform:v0.7.0
 validate() { if command -v kubeconform >/dev/null; then kubeconform -strict -exit-on-error -summary "$@"; else local file=${!#}; docker run --rm -i "${image}" -strict -exit-on-error -summary "${@:1:$#-1}" < "$file"; fi; }
 validate -ignore-missing-schemas "${workdir}/argocd.yaml"
 validate "${project_dir}/ci-deployer.yaml"