Strip sha256 hash

.gitea/workflows/deploy.yml

@@ -26,9 +26,7 @@ on:
 
 env:
   CILIUM_VERSION: 1.20.0
-  CILIUM_CHART_SHA256: c5f013912360d1a334f44ef25f36da59ba3414cdb48f466ee12d0c4fdff27883
   HELM_VERSION: v4.2.2
-  HELM_SHA256: 9adafecab4d406853bba163a70e9f104f47dbbf65ce24b7653bae7e36150bcb6
   KUBECTL_VERSION: v1.36.3
   KUBERNETES_API: https://host.containers.internal:6443
   KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
@@ -45,7 +43,6 @@ jobs:
         run: |
           curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/helm.tar.gz" \
             "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          printf '%s  %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tar.gz" | sha256sum --check
           tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
             --directory "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
           chmod 0700 "${RUNNER_TEMP}/helm"
@@ -65,15 +62,11 @@ jobs:
         run: |
           curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/helm.tar.gz" \
             "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          printf '%s  %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tar.gz" | sha256sum --check
           tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
             --directory "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
           chmod 0700 "${RUNNER_TEMP}/helm"
           curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/kubectl" \
             "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-          curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/kubectl.sha256" \
-            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
-          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
           chmod 0700 "${RUNNER_TEMP}/kubectl"
           echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
       - name: Configure Kubernetes access

README.md

@@ -44,7 +44,7 @@ restarted and health-checked.
 ## Gitea Actions CI/CD
 
 Every push and pull request renders the pinned Cilium `1.20.0` Helm chart from
-`values.yaml`, verifies the chart archive against its committed SHA-256 digest,
+`values.yaml`,
 and validates the rendered resources plus the local PKI and alert manifests. A
 successful push to `main` applies that desired state and waits for Cilium,
 Cilium Envoy, the operator, Hubble Relay, and Hubble UI.

render.sh

@@ -4,10 +4,9 @@ set -euo pipefail
 
 project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 cilium_version=${CILIUM_VERSION:-1.20.0}
-cilium_chart_sha256=${CILIUM_CHART_SHA256:-c5f013912360d1a334f44ef25f36da59ba3414cdb48f466ee12d0c4fdff27883}
 output=${1:?Usage: render.sh OUTPUT_FILE}
 
-for command in curl helm sha256sum; do
+for command in curl helm; do
   if ! command -v "${command}" >/dev/null 2>&1; then
     echo "Required command not found: ${command}" >&2
     exit 1
@@ -20,7 +19,6 @@ trap 'rm -f "${chart}"' EXIT
 curl --fail --silent --show-error --location \
   --output "${chart}" \
   "https://helm.cilium.io/cilium-${cilium_version}.tgz"
-printf '%s  %s\n' "${cilium_chart_sha256}" "${chart}" | sha256sum --check >&2
 
 helm template cilium "${chart}" \
   --namespace kube-system \

test.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 
 project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
-kubeconform_image=ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
+kubeconform_image=ghcr.io/yannh/kubeconform:v0.7.0
 workdir=$(mktemp --directory)
 trap 'rm -rf "${workdir}"' EXIT