Verify zip of protoc in generator.Dockerfile

Author: MrAlias

generator.Dockerfile

@@ -14,6 +14,9 @@ WORKDIR /src
 
 ENV EBPF_VER=v0.19.0
 ENV PROTOC_VERSION=32.0
+ENV PROTOC_X86_64_SHA256="7ca037bfe5e5cabd4255ccd21dd265f79eb82d3c010117994f5dc81d2140ee88"
+ENV PROTOC_AARCH_64_SHA256="56af3fc2e43a0230802e6fadb621d890ba506c5c17a1ae1070f685fe79ba12d0"
+
 ARG TARGETARCH
 
 RUN apk add clang llvm20 wget unzip curl wget
@@ -23,11 +26,14 @@ RUN apk cache purge
 # Deal with the arm64==aarch64 ambiguity
 RUN if [ "$TARGETARCH" = "arm64" ]; then \
         curl -qL https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-aarch_64.zip -o protoc.zip; \
+        echo "${PROTOC_AARCH_64_SHA256}  protoc.zip" > protoc.zip.sha256 ; \
     else \
         curl -qL https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip -o protoc.zip; \
-    fi
-RUN unzip protoc.zip -d /usr/local
-RUN rm protoc.zip
+        echo "${PROTOC_X86_64_SHA256}  protoc.zip" > protoc.zip.sha256 ; \
+    fi; \
+    sha256sum -c protoc.zip.sha256 \
+    && unzip protoc.zip -d /usr/local \
+    && rm protoc.zip
 
 # Install protoc-gen-go and protoc-gen-go-grpc
 RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@latest