From ae32c66e8257b08329a3cc82ab3937cacd8cac78 Mon Sep 17 00:00:00 2001
From: thuanle <tl@thuanle.me>
Date: Tue, 11 Aug 2026 15:29:22 +0700
Subject: [PATCH] fix(node-go): install golangci-lint directly, bypass
 install.sh checksum bug

The official install.sh (master branch) fails checksum verification because it
matches the .tar.gz line against the .sbom.json checksum (the tarball filename
is a prefix of the sbom filename). The downloaded tarball is NOT corrupt - its
real sha256 matches the checksums file - install.sh just picks the wrong line.

Replace install.sh with a direct tarball download + extract, reusing the
existing go_arch variable. Consistent with how Go itself is installed in this
Dockerfile (no checksum verification either).

Co-Authored-By: Claude <noreply@anthropic.com>
---
 node-go/Dockerfile | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/node-go/Dockerfile b/node-go/Dockerfile
index 6716eca..0fc64c3 100644
--- a/node-go/Dockerfile
+++ b/node-go/Dockerfile
@@ -24,10 +24,12 @@ RUN set -eux; \
     rm -rf /usr/local/go; \
     tar -C /usr/local -xzf /tmp/go.tgz; \
     rm -f /tmp/go.tgz; \
-    curl -fsSL -o /tmp/golangci-lint-install.sh \
-        "https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh"; \
-    sh /tmp/golangci-lint-install.sh -b /usr/local/bin "${GOLANGCI_LINT_VERSION}"; \
-    rm -f /tmp/golangci-lint-install.sh; \
+    gcl_ver="${GOLANGCI_LINT_VERSION#v}"; \
+    curl -fsSL -o /tmp/gcl.tgz \
+        "https://github.com/golangci/golangci-lint/releases/download/${GOLANGCI_LINT_VERSION}/golangci-lint-${gcl_ver}-${go_arch}.tar.gz"; \
+    tar -C /tmp -xzf /tmp/gcl.tgz; \
+    install -m 0755 "/tmp/golangci-lint-${gcl_ver}-${go_arch}/golangci-lint" /usr/local/bin/golangci-lint; \
+    rm -rf /tmp/gcl.tgz "/tmp/golangci-lint-${gcl_ver}-${go_arch}"; \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app