From 2b14f3da9e546b8edff7c900c22451fd89d52886 Mon Sep 17 00:00:00 2001
From: Adam Wolfe Gordon <awg@upbound.io>
Date: Thu, 30 Jul 2026 15:31:11 -0600
Subject: [PATCH] build: Calculate checksums after the nix fixup phase

crossplane/crossplane#7467 reported that checksums for the amd64 crank binaries
in our releases are incorrect. It turns out this applies to both the CLI (now
the crossplane binary from this repository) and the core crossplane controller
binary (the crossplane binary in c/c).

The issue is that Nix strips binaries in its `fixup` build phase, which runs
after our `postInstall` hook. The stripping applies only to binaries for the
host architecture, which in our release actions is always amd64.

Calculate checksums in the `postFixup` phase so that we checksum the already
stripped binary. Add a checksum verification step before uploading artifacts to
catch any similar issues in the future.

Signed-off-by: Adam Wolfe Gordon <awg@upbound.io>
---
 .github/workflows/ci.yml | 11 +++++++++++
 nix/build.nix            |  3 +++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a17829f..69ef969 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -160,6 +160,17 @@ jobs:
       - name: Build Artifacts
         run: nix build .#release --option warn-dirty false --print-build-logs
 
+      - name: Validate Artifacts
+        run: |
+          for f in $(find result/ -type f -not -name '*.sha256'); do
+            want=$(sha256sum "${f}" | head -c 64)
+            got=$(cat "${f}.sha256")
+            if [[ "${want}" != "${got}" ]]; then
+              echo "File ${f} has incorrect checksum; want ${want}, got ${got}"
+              exit 1
+            fi
+          done
+
       - name: Upload Artifacts
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
diff --git a/nix/build.nix b/nix/build.nix
index 5dd1874..c016e13 100644
--- a/nix/build.nix
+++ b/nix/build.nix
@@ -45,6 +45,9 @@ let
           mv $out/bin/${platform.os}_${platform.arch}/* $out/bin/
           rmdir $out/bin/${platform.os}_${platform.arch}
         fi
+      '';
+
+      postFixup = ''
         cd $out/bin
         sha256sum ${pname}${ext} | head -c 64 > ${pname}${ext}.sha256
       '';