From 328d24e82d69b70727972fb1efbeb4902adf6ba7 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 14 Oct 2026 20:17:01 +0200
Subject: [PATCH] Strip sha256 hash

---
 .gitea/workflows/deploy.yml | 7 -------
 README.md                   | 2 +-
 render.sh                   | 4 +---
 test.sh                     | 2 +-
 4 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ba7b3b9..8b66392 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -26,9 +26,7 @@ on:
 
 env:
   CILIUM_VERSION: 1.20.0
-  CILIUM_CHART_SHA256: c5f013912360d1a334f44ef25f36da59ba3414cdb48f466ee12d0c4fdff27883
   HELM_VERSION: v4.2.2
-  HELM_SHA256: 9adafecab4d406853bba163a70e9f104f47dbbf65ce24b7653bae7e36150bcb6
   KUBECTL_VERSION: v1.36.3
   KUBERNETES_API: https://host.containers.internal:6443
   KUBERNETES_TLS_SERVER_NAME: 192.168.0.2
@@ -45,7 +43,6 @@ jobs:
         run: |
           curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/helm.tar.gz" \
             "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          printf '%s  %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tar.gz" | sha256sum --check
           tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
             --directory "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
           chmod 0700 "${RUNNER_TEMP}/helm"
@@ -65,15 +62,11 @@ jobs:
         run: |
           curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/helm.tar.gz" \
             "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          printf '%s  %s\n' "${HELM_SHA256}" "${RUNNER_TEMP}/helm.tar.gz" | sha256sum --check
           tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
             --directory "${RUNNER_TEMP}" --strip-components=1 linux-amd64/helm
           chmod 0700 "${RUNNER_TEMP}/helm"
           curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/kubectl" \
             "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-          curl --fail --silent --show-error --location --output "${RUNNER_TEMP}/kubectl.sha256" \
-            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
-          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
           chmod 0700 "${RUNNER_TEMP}/kubectl"
           echo "${RUNNER_TEMP}" >> "${GITHUB_PATH}"
       - name: Configure Kubernetes access
diff --git a/README.md b/README.md
index ced3cc4..ef26063 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ restarted and health-checked.
 ## Gitea Actions CI/CD
 
 Every push and pull request renders the pinned Cilium `1.20.0` Helm chart from
-`values.yaml`, verifies the chart archive against its committed SHA-256 digest,
+`values.yaml`,
 and validates the rendered resources plus the local PKI and alert manifests. A
 successful push to `main` applies that desired state and waits for Cilium,
 Cilium Envoy, the operator, Hubble Relay, and Hubble UI.
diff --git a/render.sh b/render.sh
index 8a9611c..a80a9b9 100755
--- a/render.sh
+++ b/render.sh
@@ -4,10 +4,9 @@ set -euo pipefail
 
 project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 cilium_version=${CILIUM_VERSION:-1.20.0}
-cilium_chart_sha256=${CILIUM_CHART_SHA256:-c5f013912360d1a334f44ef25f36da59ba3414cdb48f466ee12d0c4fdff27883}
 output=${1:?Usage: render.sh OUTPUT_FILE}
 
-for command in curl helm sha256sum; do
+for command in curl helm; do
   if ! command -v "${command}" >/dev/null 2>&1; then
     echo "Required command not found: ${command}" >&2
     exit 1
@@ -20,7 +19,6 @@ trap 'rm -f "${chart}"' EXIT
 curl --fail --silent --show-error --location \
   --output "${chart}" \
   "https://helm.cilium.io/cilium-${cilium_version}.tgz"
-printf '%s  %s\n' "${cilium_chart_sha256}" "${chart}" | sha256sum --check >&2
 
 helm template cilium "${chart}" \
   --namespace kube-system \
diff --git a/test.sh b/test.sh
index 7a12bde..e9af57f 100755
--- a/test.sh
+++ b/test.sh
@@ -3,7 +3,7 @@
 set -euo pipefail
 
 project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
-kubeconform_image=ghcr.io/yannh/kubeconform:v0.7.0@sha256:85dbef6b4b312b99133decc9c6fc9495e9fc5f92293d4ff3b7e1b30f5611823c
+kubeconform_image=ghcr.io/yannh/kubeconform:v0.7.0
 workdir=$(mktemp --directory)
 trap 'rm -rf "${workdir}"' EXIT