From 3c65ed19cd759b12d480c1d3fd3a396d72814ad0 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Wed, 11 Nov 2026 12:28:35 +0100
Subject: [PATCH 1/2] pkg/*: use '.sha256sum' extension for checksums

commit 810d7bd601d2350906c5088b40e5ef9e5483fb1a introduced checksums for
static binaries. These checksums use the standard format produced by
sha256sum, which includes both the checksum and filename.

When adding checksum validation to the official docker:dind image repository,
there was discussion which format is most expected for a per-file checksum;
using the sha256sum format allows `sha256sum -c <package>.sha256` to verify
the package, but there's also various situations where a bare checksum is
preferable.

Unfortunately, there are no strict conventions here; either option makes
sense. However, some further searching for precedents / conventions led
me to the containerd repository; containerd publishes checksums and also
uses the `sha256sum` format. However, those files use a `.sha256sum` file-
extension (see [containerd@650a7e5]).

Using `.sha256sum` as file-extension makes the format less ambiguous; it
also keeps a path open to publish _both_ a bare checksum _and_ a sha256sum
format. It also aligns with the conventions used by containerd, which gives
some consistency between related projects.

Given that we didn't ship a stable release yet with these checksums, we can
still make changes. This patch renames the checksumfiles to use `.sha256sum`
as file-extension.

updates 810d7bd601d2350906c5088b40e5ef9e5483fb1a
updates 7d994c2d1fe6320f75c0242d78c77687cdc4ed46

[containerd@650a7e5]: https://github.com/containerd/containerd/commit/650a7e5c1ec3a2d5752ce3868813f6813baf240c

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 hack/scripts/write-sha256sum.sh          | 2 +-
 pkg/agent/verify.Dockerfile              | 2 +-
 pkg/buildx/verify.Dockerfile             | 2 +-
 pkg/compose/verify.Dockerfile            | 2 +-
 pkg/containerd/verify.Dockerfile         | 2 +-
 pkg/credential-helpers/verify.Dockerfile | 2 +-
 pkg/docker-cli/verify.Dockerfile         | 2 +-
 pkg/docker-engine/verify.Dockerfile      | 2 +-
 pkg/docker/verify.Dockerfile             | 6 +++---
 pkg/model/verify.Dockerfile              | 2 +-
 10 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/hack/scripts/write-sha256sum.sh b/hack/scripts/write-sha256sum.sh
index faa57ad9..907deeb4 100755
--- a/hack/scripts/write-sha256sum.sh
+++ b/hack/scripts/write-sha256sum.sh
@@ -36,5 +36,5 @@ esac
 (
   set -x
   cd "$dir"
-  sha256sum --binary "$name" > "${name}.sha256"
+  sha256sum --binary "$name" > "${name}.sha256sum"
 )
diff --git a/pkg/agent/verify.Dockerfile b/pkg/agent/verify.Dockerfile
index 857c4e1d..8c91dcbb 100644
--- a/pkg/agent/verify.Dockerfile
+++ b/pkg/agent/verify.Dockerfile
@@ -109,7 +109,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/local --strip-components=1
     )
   done
diff --git a/pkg/buildx/verify.Dockerfile b/pkg/buildx/verify.Dockerfile
index ade53902..cf134799 100644
--- a/pkg/buildx/verify.Dockerfile
+++ b/pkg/buildx/verify.Dockerfile
@@ -109,7 +109,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/local --strip-components=1
     )
   done
diff --git a/pkg/compose/verify.Dockerfile b/pkg/compose/verify.Dockerfile
index 48b5a048..ffdb708b 100644
--- a/pkg/compose/verify.Dockerfile
+++ b/pkg/compose/verify.Dockerfile
@@ -109,7 +109,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/local --strip-components=1
     )
   done
diff --git a/pkg/containerd/verify.Dockerfile b/pkg/containerd/verify.Dockerfile
index c2aee5c5..9d0dbc72 100644
--- a/pkg/containerd/verify.Dockerfile
+++ b/pkg/containerd/verify.Dockerfile
@@ -113,7 +113,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/local --strip-components=1
     )
   done
diff --git a/pkg/credential-helpers/verify.Dockerfile b/pkg/credential-helpers/verify.Dockerfile
index 6879e7dd..68ae40ea 100644
--- a/pkg/credential-helpers/verify.Dockerfile
+++ b/pkg/credential-helpers/verify.Dockerfile
@@ -122,7 +122,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/local --strip-components=1
     )
   done
diff --git a/pkg/docker-cli/verify.Dockerfile b/pkg/docker-cli/verify.Dockerfile
index fd584370..619c45c1 100644
--- a/pkg/docker-cli/verify.Dockerfile
+++ b/pkg/docker-cli/verify.Dockerfile
@@ -109,7 +109,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/local --strip-components=1
     )
   done
diff --git a/pkg/docker-engine/verify.Dockerfile b/pkg/docker-engine/verify.Dockerfile
index bf03c279..615fccbc 100644
--- a/pkg/docker-engine/verify.Dockerfile
+++ b/pkg/docker-engine/verify.Dockerfile
@@ -122,7 +122,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/local --strip-components=1
     )
   done
diff --git a/pkg/docker/verify.Dockerfile b/pkg/docker/verify.Dockerfile
index 2cdbdd59..051004e6 100644
--- a/pkg/docker/verify.Dockerfile
+++ b/pkg/docker/verify.Dockerfile
@@ -48,7 +48,7 @@ RUN --mount=from=bin,target=/build <<EOT
       (
         set -x
         cd "${package%/*}"
-        sha256sum -c "${package##*/}.sha256"
+        sha256sum -c "${package##*/}.sha256sum"
         workdir=$(mktemp -d -t docker-verify.XXXXXXXXXX)
         tar zxvf "${package##*/}" -C "$workdir"
         xx-verify --static "$workdir/docker/docker"
@@ -70,7 +70,7 @@ RUN --mount=from=bin,target=/build <<EOT
       (
         set -x
         cd "${package%/*}"
-        sha256sum -c "${package##*/}.sha256"
+        sha256sum -c "${package##*/}.sha256sum"
         unzip -l "${package##*/}"
         workdir=$(mktemp -d -t docker-verify.XXXXXXXXXX)
         unzip -q "${package##*/}" -d $workdir
@@ -91,7 +91,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/bin --strip-components=1
     )
   done
diff --git a/pkg/model/verify.Dockerfile b/pkg/model/verify.Dockerfile
index 30e4549a..84f0792e 100644
--- a/pkg/model/verify.Dockerfile
+++ b/pkg/model/verify.Dockerfile
@@ -109,7 +109,7 @@ RUN --mount=from=bin,target=/build <<EOT
     (
       set -x
       cd "${package%/*}"
-      sha256sum -c "${package##*/}.sha256"
+      sha256sum -c "${package##*/}.sha256sum"
       tar zxvf "${package##*/}" -C /usr/local --strip-components=1
     )
   done

From 778b2d94dd6c8a1294a48a2519a54582b7cfb39c Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Wed, 11 Nov 2026 12:40:24 +0100
Subject: [PATCH 2/2] pkg/*: add bare SHA256 checksum files

Publish bare hexadecimal digests in `.sha256` files, alongside
`.sha256sum` files containing the standard sha256sum output.

This supports consumers expecting a bare checksum while preserving
compatibility with `sha256sum --check`.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
 hack/scripts/write-sha256sum.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hack/scripts/write-sha256sum.sh b/hack/scripts/write-sha256sum.sh
index 907deeb4..8431c268 100755
--- a/hack/scripts/write-sha256sum.sh
+++ b/hack/scripts/write-sha256sum.sh
@@ -36,5 +36,7 @@ esac
 (
   set -x
   cd "$dir"
+  # Write both sha256sum-compatible and bare-digest checksums.
   sha256sum --binary "$name" > "${name}.sha256sum"
+  cut -d ' ' -f 1 "${name}.sha256sum" > "${name}.sha256"
 )