Update Dockerfile

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: yqtian-se

Dockerfile

@@ -12,9 +12,13 @@ RUN case "${TARGETARCH}" in \
       arm64) HUGO_ARCH="arm64" ;; \
       *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
     esac \
-    && wget -q -O /tmp/hugo.tar.gz "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-${HUGO_ARCH}.tar.gz" \
-    && tar -xzf /tmp/hugo.tar.gz -C /usr/local/bin hugo \
-    && rm -f /tmp/hugo.tar.gz
+    && HUGO_TARBALL="hugo_extended_${HUGO_VERSION}_linux-${HUGO_ARCH}.tar.gz" \
+    && wget -q -O "/tmp/${HUGO_TARBALL}" "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${HUGO_TARBALL}" \
+    && wget -q -O /tmp/hugo_checksums.txt "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_checksums.txt" \
+    && grep " ${HUGO_TARBALL}\$" /tmp/hugo_checksums.txt > /tmp/hugo_checksums_entry.txt \
+    && sha256sum -c /tmp/hugo_checksums_entry.txt \
+    && tar -xzf "/tmp/${HUGO_TARBALL}" -C /usr/local/bin hugo \
+    && rm -f "/tmp/${HUGO_TARBALL}" /tmp/hugo_checksums.txt /tmp/hugo_checksums_entry.txt
 
 WORKDIR /src