chore(deps): 2025.12.0

adds wget back, and removes checksum verification.

since github added automatic checksums, bitwarden stopped publishing the
txt checksum files. extracting the checksum hash from github releases is
non-trivial and would require a lot of changes to the Dockerfile that
wouldn't be reflected on the external-secrets documentation page.

the point of this repo is to be in lock-step with those docs, so i'm
removing it. if someone adds the checksum verification logic to the
`Dockerfile` on docs page, i will add it back here

refs:
    - #7

Author: charlesthomas

Dockerfile

@@ -1,27 +1,15 @@
-FROM alpine:latest AS downloader
-
-ARG BW_VERSION=2025.6.1
-
-RUN apk update --no-cache \
- && apk add --no-cache curl jq \
- && curl -sLo bw.zip "https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-oss-linux-${BW_VERSION}.zip" \
- && echo $(\
-    curl -sL "https://api.github.com/repos/bitwarden/clients/releases/tags/cli-v${BW_VERSION}" | \
-    jq -r ".assets[] | select(.name == \"bw-oss-linux-${BW_VERSION}.zip\") .digest" | \
-    cut -f2 -d:) bw.zip > sum.txt \
- && sha256sum -sc sum.txt \
- && unzip bw.zip
-
 FROM debian:sid
 
-COPY --from=downloader bw /usr/local/bin/
-
-USER 1000
-
-WORKDIR /bw
+ARG BW_CLI_VERSION=2025.12.0
 
-ENV HOME=/bw
+RUN apt update && \
+    apt install -y wget unzip && \
+    wget https://github.com/bitwarden/clients/releases/download/cli-v${BW_CLI_VERSION}/bw-oss-linux-${BW_CLI_VERSION}.zip && \
+    unzip bw-linux-${BW_CLI_VERSION}.zip && \
+    chmod +x bw && \
+    mv bw /usr/local/bin/bw && \
+    rm -rfv *.zip
 
 COPY entrypoint.sh /
 
-ENTRYPOINT ["/entrypoint.sh"]
+CMD ["/entrypoint.sh"]

README.md

@@ -6,7 +6,7 @@ this is based on the code in the [external-secrets documentation](https://extern
 
 both the `Dockerfile` and `entrypoint.sh` are a near-identical copy/paste.
 
-the only changes are to the `Dockerfile` to add shasum checking (thanks [majabojarska](https://github.com/majabojarska)!), and to convert `BW_CLI_VERSION` from an `ENV` to an `ARG`,
+the only changes are to the `Dockerfile` to convert `BW_CLI_VERSION` from an `ENV` to an `ARG`,
 so that the official upstream version can be read from the `VERISON` file for the `ARG` as well as the image tag
 
 # tag convention

VERSION

@@ -1 +1 @@
-2025.6.1
+2025.12.0