Verify download

Author: p3lim

.github/workflows/update.yaml

@@ -26,9 +26,18 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
 
-      - name: Update version string
+      - name: Get digest
+        id: digest
+        run: |
+          {
+            echo -n 'digest='
+            gh api repos/bitwarden/clients/releases/tags/cli-v${{ steps.version.outputs.version }} -q '.assets[] | select(name | startswith("bw-oss-linux")) | .digest | split(":") | last'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Update version and digest
         run: |
           sed -Ei 's/(BW_VERSION=)[0-9.]+/\1${{ steps.version.outputs.version }}/' Dockerfile
+          sed -Ei 's/(BW_DIGEST=)[a-f0-9]+/\1${{ steps.digest.outputs.version }}/' Dockerfile
 
       - name: Create pull request
         uses: peter-evans/create-pull-request@v7

Dockerfile

@@ -1,6 +1,7 @@
 FROM debian:13.2-slim
 
 ARG BW_VERSION=2025.11.0
+ARG BW_DIGEST=abc
 ENV DEBIAN_FRONTEND=noninteractive
 
 # install bitwarden-cli
@@ -10,6 +11,7 @@ RUN <<EOF
   apt-get clean
   rm -rf /var/lib/apt/lists/*
   wget --no-verbose "https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-oss-linux-${BW_VERSION}.zip"
+  sha256sum -c - <<< "$BW_DIGEST bw-oss-linux-${BW_VERSION}.zip"
   unzip "bw-oss-linux-${BW_VERSION}.zip"
   rm -fv "bw-oss-linux-${BW_VERSION}.zip"
   mv bw /usr/local/bin/