From 1ea79925d89fb695751dcfa84c15a5dbf3cc5b0e Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 14 Oct 2026 20:14:45 +0200
Subject: [PATCH] Strip sha256 hash

---
 Dockerfile           | 4 ++--
 hack/install-helm.sh | 9 ---------
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index bb55cd7..e4b4abb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,11 @@
-FROM golang:1.26-bookworm@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514 AS build
+FROM golang:1.26-bookworm AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -buildvcs=false -trimpath -ldflags="-s -w" -o /manager ./cmd/manager
 
-FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
+FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /manager /manager
 USER 65532:65532
 ENTRYPOINT ["/manager"]
diff --git a/hack/install-helm.sh b/hack/install-helm.sh
index 10d2a58..f27984f 100644
--- a/hack/install-helm.sh
+++ b/hack/install-helm.sh
@@ -5,19 +5,10 @@ set -euo pipefail
 : "${RUNNER_TEMP:?RUNNER_TEMP must be set}"
 
 archive="helm-${HELM_VERSION}-linux-amd64.tar.gz"
-checksum="${archive}.sha256sum"
 
 curl --fail --silent --show-error --location \
   --output "${RUNNER_TEMP}/${archive}" \
   "https://get.helm.sh/${archive}"
-curl --fail --silent --show-error --location \
-  --output "${RUNNER_TEMP}/${checksum}" \
-  "https://get.helm.sh/${checksum}"
-
-# The upstream checksum contains the upstream archive basename, so preserve
-# that basename and perform the check from its containing directory.
-(cd "${RUNNER_TEMP}" && sha256sum --check "${checksum}")
-
 tar --extract --gzip --file "${RUNNER_TEMP}/${archive}" \
   --directory "${RUNNER_TEMP}" linux-amd64/helm
 mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"