Skip to content

Make SHA256 checksum usage for Docker image dependencies more consistent

While updating the git lfs version I noticed a couple of things that hindered me, so we might want to improve on them for the future:

  • GIT_LFS_*_CHECKSUM values refer to the binary inside the .tar.gz file we download from the project repo. It would be much easier to check the SHA256 of the .tar.gz we download from the GitHub repo, since those are described in the release page (under the SHA-256 hashes section). Currently we need to manually download the archive, unzip it and compute with sha256sum.
  • GIT_LFS_256_CHECKSUM is another value that is used for the prepare ci image job. This one uses the approach I suggest in the point above though, so there is inconsistency. I’d propose one change here though: rename GIT_LFS_256_CHECKSUM to GIT_LFS_AMD64_CHECKSUM, move the checksums to a helper job and just remove the variable definition from the prepare ci image job.
Edited by Pedro Pombeiro