From c80ce2a37bff584c2b955fbf4285198688bf9b9f Mon Sep 17 00:00:00 2001
From: Lysias <lysias@linkridge.net>
Date: Tue, 1 Sep 2026 00:48:45 +0000
Subject: [PATCH] fix(container): install gitleaks from release binaries on
 multi-arch CI

QEMU-emulated `go install` of gitleaks v8.30.0 fails the scheduled
linux/amd64,linux/arm64 GHCR build (run 33391871123, issue #60).
Download the official linux x64/arm64 tarballs and verify SHA-256
against the upstream checksums.txt instead.

Closes #60
---
 CHANGELOG.md |  7 +++++++
 Dockerfile   | 23 ++++++++++++++++++++---
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5df778b..440daff 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Install gitleaks from official release binaries (linux amd64/arm64) instead
+  of `go install` under QEMU, which failed the 2026-08-31 multi-arch scheduled
+  build (run 33391871123, issue #60). Checksums are verified against the
+  upstream release `checksums.txt`.
+
 ## [1.12.10] - 2026-07-30
 
 ### Added
diff --git a/Dockerfile b/Dockerfile
index 82e02fc..f2b0689 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,10 +14,27 @@ RUN go install github.com/terraform-linters/tflint@latest
 # Install terraform-docs
 RUN go install github.com/terraform-docs/terraform-docs@latest
 
-# Install gitleaks (pin version + inject via ldflags so `gitleaks version` reports correctly)
+# Install gitleaks from official release binaries.
+# Compiling via `go install` under QEMU for linux/arm64 OOMs/fails the
+# multi-arch GHCR build (2026-08-31 run 33391871123 / issue #60). Official
+# binaries are already version-stamped; checksums come from the release.
 ARG GITLEAKS_VERSION=v8.30.0
-RUN go install -ldflags "-X github.com/zricethezav/gitleaks/v8/version.Version=${GITLEAKS_VERSION}" \
-    github.com/zricethezav/gitleaks/v8@${GITLEAKS_VERSION}
+RUN set -eux; \
+    case "${TARGETARCH}" in \
+      amd64) _arch=x64 ;; \
+      arm64) _arch=arm64 ;; \
+      *) echo "unsupported TARGETARCH=${TARGETARCH}"; exit 1 ;; \
+    esac; \
+    _ver="${GITLEAKS_VERSION#v}"; \
+    _base="https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}"; \
+    _tar="gitleaks_${_ver}_linux_${_arch}.tar.gz"; \
+    mkdir -p /go/bin; \
+    curl -fsSL -o "/tmp/${_tar}" "${_base}/${_tar}"; \
+    curl -fsSL -o /tmp/gitleaks_checksums.txt "${_base}/gitleaks_${_ver}_checksums.txt"; \
+    grep " ${_tar}\$" /tmp/gitleaks_checksums.txt | (cd /tmp && sha256sum -c -); \
+    tar -xz -C /go/bin --no-same-owner -f "/tmp/${_tar}" gitleaks; \
+    rm -f "/tmp/${_tar}" /tmp/gitleaks_checksums.txt; \
+    /go/bin/gitleaks version
 
 # Install golangci-lint v2
 RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest