[Frawless]

Type of Change

• Enhancement / new feature

Description

The dependency actions downloaded binaries without verifying them. They now check the SHA-256 checksum and fail on a mismatch:

• syft – syft_<version>_checksums.txt
• yq – checksums + checksums_hashes_order (works for old versions such as v4.6.3 too)
• kubectl, minikube, kind – the .sha256 / .sha256sum file published next to each binary
• ShellCheck – no checksum file is published, so the SHA-256 digest GitHub records for the release asset is used

Helm was already verified by get_helm.sh.

Important

GitHub records asset digests only for releases uploaded since mid-2025, so install-shellcheck now requires ShellCheck 0.11.0 or newer. 0.10.0 was removed from the test matrix and the README notes the minimum.

Checklist

• Update documentation
• Write tests
• Make sure all tests pass
• Try your changes inside a Kubernetes cluster, not just from unit tests
• AI assistance was used to create this PR (see the Strimzi AI policy)

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}