[slayerjain]

What changed

keploy-ci-golint/Dockerfile: comments only. The install itself is unchanged.

The comment above the golangci-lint install said upstream's install.sh "cannot install any version we are able to use here". That is true only of the copies older than golangci/golangci-lint#6539:

• The copy on golangci-lint's master branch, which raw.githubusercontent.com/golangci/golangci-lint/master/install.sh still serves. master has not moved since March 2025; upstream works on main.
• The copies at the v2.12.0 and earlier tags.

Those copies look the checksum up with an unanchored grep "${BASENAME}". From v2.12.0, each release's checksums file also lists <tarball>.sbom.json, so that grep matches two lines and the verify fails. #6539 (merged to main 2026-05-01, first tagged in v2.12.1) anchored it as grep "${BASENAME}$". Main's install.sh installs v2.15.0. https://golangci-lint.run/install.sh serves that same copy, and so does the v2.15.0 tag.

The comment now:

• says which copy fails (master's) and which works (main's, served by golangci-lint.run);
• puts the SBOM cut-off at v2.12.0, not v2.13.0;
• quotes master's grep line exactly;
• says the refusal compares the build Go's language version;
• says why the install stays by hand: it makes the same checksum check, matched on the exact filename, and fetches no install script at build time.

What was checked

• https://golangci-lint.run/install.sh, raw.githubusercontent.com/golangci/golangci-lint/main/install.sh and .../v2.15.0/install.sh are byte-identical (sha256 1022ddb4...). curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b <dir> v2.15.0 installs golangci-lint has version 2.15.0 built with go1.27.0 from 25c5369a. That is the same build golangci-lint --version reports in ghcr.io/keploy/keploy-ci:golint-1.2.49.
• master's copy, given v2.15.0, fails: err hash_sha256_verify checksum for '.../golangci-lint-2.15.0-linux-arm64.tar.gz' did not verify followed by two hashes.
• Checksums files: v2.11.4 has no .sbom.json lines. v2.12.0 through v2.15.0 each have 27, one per binary archive.
• The v2.12.0 tag's install.sh has the unanchored grep. v2.12.1's has the anchored one.