From 72f12660780deb7a8f91229e0f8bf5eecb318636 Mon Sep 17 00:00:00 2001
From: john <cynell@139.com>
Date: Wed, 15 Jul 2026 11:48:09 +0800
Subject: [PATCH] fix: make imgproxy artifact checksums portable

---
 scripts/build-imgproxy-runtime-image.sh   | 4 ++--
 scripts/imgproxy-runtime-package.test.mjs | 2 ++
 scripts/release-imgproxy-runtime-prod.sh  | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/scripts/build-imgproxy-runtime-image.sh b/scripts/build-imgproxy-runtime-image.sh
index b250bb3..6d76b58 100644
--- a/scripts/build-imgproxy-runtime-image.sh
+++ b/scripts/build-imgproxy-runtime-image.sh
@@ -17,9 +17,9 @@ fi
 
 command -v docker >/dev/null || { echo 'docker is required to build the imgproxy runtime image' >&2; exit 1; }
 if ! docker image inspect "$IMAGE_REF" >/dev/null 2>&1; then
-  docker pull --platform linux/arm64 "$IMAGE_REF"
+docker pull --platform linux/arm64 "$IMAGE_REF"
 fi
 docker tag "$IMAGE_REF" "$IMAGE_TAG"
 docker save "$IMAGE_TAG" | gzip -c > "$OUT_DIR/imgproxy-runtime-image.tar.gz"
-shasum -a 256 "$OUT_DIR/imgproxy-runtime-image.tar.gz" > "$OUT_DIR/imgproxy-runtime-image.tar.gz.sha256"
+(cd "$OUT_DIR" && shasum -a 256 imgproxy-runtime-image.tar.gz > imgproxy-runtime-image.tar.gz.sha256)
 printf '%s\n' "$IMAGE_TAG" > "$OUT_DIR/image-tag.txt"
diff --git a/scripts/imgproxy-runtime-package.test.mjs b/scripts/imgproxy-runtime-package.test.mjs
index 1806cab..3d26549 100644
--- a/scripts/imgproxy-runtime-package.test.mjs
+++ b/scripts/imgproxy-runtime-package.test.mjs
@@ -14,6 +14,7 @@ test('imgproxy runtime pins an arm64 image digest', () => {
 test('builder reuses an already verified digest without a network pull', () => {
   const builder = read('scripts/build-imgproxy-runtime-image.sh');
   assert.match(builder, /docker image inspect "\$IMAGE_REF"/);
+  assert.match(builder, /shasum -a 256 imgproxy-runtime-image\.tar\.gz/);
 });
 
 test('installer uses a read-only storage mount and both required ports', () => {
@@ -27,6 +28,7 @@ test('installer uses a read-only storage mount and both required ports', () => {
 test('release verifies checksums before loading the image and backs up launch state', () => {
   const release = read('scripts/release-imgproxy-runtime-prod.sh');
   assert.match(release, /shasum -a 256 -c/);
+  assert.match(release, /shasum -a 256 "imgproxy-runtime-\$RELEASE_ID\.tar\.gz"/);
   assert.match(release, /docker load/);
   assert.match(release, /imgproxy-compat-\$RELEASE_ID\.plist/);
   assert.match(release, /img\.tkmind\.cn\/health/);
diff --git a/scripts/release-imgproxy-runtime-prod.sh b/scripts/release-imgproxy-runtime-prod.sh
index 488205e..deeb23a 100644
--- a/scripts/release-imgproxy-runtime-prod.sh
+++ b/scripts/release-imgproxy-runtime-prod.sh
@@ -31,7 +31,7 @@ cp "$IMAGE_DIR"/* "$TMP/runtime/"
 cp "$ROOT/scripts/install-imgproxy-runtime-prod.sh" "$ROOT/scripts/imgproxy-compat-proxy.mjs" "$TMP/runtime/"
 chmod 755 "$TMP/runtime/install-imgproxy-runtime-prod.sh"
 tar -C "$TMP" -czf "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz" runtime
-shasum -a 256 "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz" > "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz.sha256"
+(cd "$TMP" && shasum -a 256 "imgproxy-runtime-$RELEASE_ID.tar.gz" > "imgproxy-runtime-$RELEASE_ID.tar.gz.sha256")
 
 ssh -o BatchMode=yes "$HOST" "mkdir -p '$INCOMING'"
 scp -q "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz" "$TMP/imgproxy-runtime-$RELEASE_ID.tar.gz.sha256" "$HOST:$INCOMING/"