Check restic binary SHA hash on download (#5819)

kanisterio · Jun 14, 2019 · 9c7f8c1 · 9c7f8c1
1 parent ec60e05
commit 9c7f8c1
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/docker/tools/Dockerfile b/docker/tools/Dockerfile
@@ -2,8 +2,10 @@ FROM busybox:glibc as restbox
 
 # Get restic executable
 ENV RESTIC_VERSION=0.9.5
+ENV RESTIC_SHA=08cd75e56a67161e9b16885816f04b2bf1fb5b03bc0677b0ccf3812781c1a2ec
 ADD https://github.com/restic/restic/releases/download/v${RESTIC_VERSION}/restic_${RESTIC_VERSION}_linux_amd64.bz2 /
-RUN bzip2 -d restic_${RESTIC_VERSION}_linux_amd64.bz2 && mv restic_${RESTIC_VERSION}_linux_amd64 /bin/restic && chmod +x /bin/restic
+RUN echo "${RESTIC_SHA}  restic_${RESTIC_VERSION}_linux_amd64.bz2" | sha256sum -c \
+    && bzip2 -d restic_${RESTIC_VERSION}_linux_amd64.bz2 && mv restic_${RESTIC_VERSION}_linux_amd64 /bin/restic && chmod +x /bin/restic
 
 FROM alpine:3.7
 MAINTAINER Tom Manville <tom@kasten.io>