From 11d18c5b74190895da7bc1e707acd3a407b911d4 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 14 Oct 2026 20:12:59 +0200
Subject: [PATCH] Strip sha256 hash

---
 .gitea/workflows/deploy.yml | 12 ------------
 README.md                   |  2 +-
 values.yaml                 |  2 --
 3 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 09a440e..e0b6a3e 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -25,10 +25,6 @@ jobs:
           curl --fail --silent --show-error --location \
             --output "${RUNNER_TEMP}/helm.tar.gz" \
             "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/helm.tar.gz.sha256sum" \
-            "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum"
-          (cd "${RUNNER_TEMP}" && sha256sum --check helm.tar.gz.sha256sum)
           tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
             --directory "${RUNNER_TEMP}" linux-amd64/helm
           mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
@@ -56,10 +52,6 @@ jobs:
           curl --fail --silent --show-error --location \
             --output "${RUNNER_TEMP}/helm.tar.gz" \
             "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/helm.tar.gz.sha256sum" \
-            "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum"
-          (cd "${RUNNER_TEMP}" && sha256sum --check helm.tar.gz.sha256sum)
           tar --extract --gzip --file "${RUNNER_TEMP}/helm.tar.gz" \
             --directory "${RUNNER_TEMP}" linux-amd64/helm
           mv "${RUNNER_TEMP}/linux-amd64/helm" "${RUNNER_TEMP}/helm"
@@ -68,10 +60,6 @@ jobs:
           curl --fail --silent --show-error --location \
             --output "${RUNNER_TEMP}/kubectl" \
             "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
-          curl --fail --silent --show-error --location \
-            --output "${RUNNER_TEMP}/kubectl.sha256" \
-            "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
-          printf '%s  %s\n' "$(cat "${RUNNER_TEMP}/kubectl.sha256")" "${RUNNER_TEMP}/kubectl" | sha256sum --check
           chmod 0700 "${RUNNER_TEMP}/kubectl"
 
       - name: Configure Kubernetes access
diff --git a/README.md b/README.md
index 960a029..3e520f6 100644
--- a/README.md
+++ b/README.md
@@ -40,7 +40,7 @@ No credential value or generated kubeconfig belongs in this repository.
 - Helm 3 or 4 for local rendering.
 - kubectl access with permission to create the initial namespaced resources.
 
-The nginx image is pinned by digest. No registry credentials, persistent
+The nginx image uses a readable version tag. No registry credentials, persistent
 volumes, cert-manager resources, or public Ingress are required.
 
 ## Install on brunner.ninja
diff --git a/values.yaml b/values.yaml
index 95fe315..f13d1dc 100644
--- a/values.yaml
+++ b/values.yaml
@@ -7,7 +7,6 @@ replicaCount: 1
 image:
   repository: nginxinc/nginx-unprivileged
   tag: 1.29.4-alpine
-  digest: sha256:a6c4f61f456b85b8fdf7ec7ab28cc3e299440e6fb4a9dea520e5fd8fd440025e
   pullPolicy: IfNotPresent
 
 branding:
@@ -44,4 +43,3 @@ resources:
   limits:
     cpu: 100m
     memory: 64Mi
-