Repository navigation
Use online checksums in Dockerfiles where possible #6548
Description
Instead of having hardcoded checksum values, we should fetch checksum files from the internet at build time (where possible). In combination with #6266, this makes our Dockerfiles more flexibility and makes them simpler to maintain.
- .NET runtime/aspnet/sdk
Activity
lbussell commentedon Jul 22, 2025
MinGit is the only .NET image component I see that doesn't upload its own checksum files. They are listed in the body of the GitHub release (example). However, the sha256 is also available via the GitHub API: https://github.com/orgs/community/discussions/23512#discussioncomment-13360044. This is a very recent addition to GitHub releases. It will take some experimenting to see if we can get this into a one-liner, but even then, we might be subject to GitHub API rate-limiting if we don't authenticate inside the Dockerfile.
lbussell commentedon Jul 23, 2025
The easy-path for Arcade repos to generate checksums is by using the GenerateChecksumItems task. It outputs a bare checksum file, which isn't ideal for Linux use cases. I filed dotnet/arcade#15994 for adding an option to generate checksum files in the standard
sha512sumformat.