Use online checksums for downloading Chisel

documentation/ubuntu-chiseled.md

@@ -56,7 +56,7 @@ FROM mcr.microsoft.com/dotnet/nightly/sdk:10.0-noble AS chisel
 # Find the latest chisel releases: https://github.com/canonical/chisel/releases
 ARG CHISEL_VERSION="v1.X.X"
 # Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
-ARG CHISEL_WRAPPER_VERSION="v1.X.X"
+ARG ROCKS_TOOLBOX_VERSION="v1.X.X"
 
 # Install chisel's dependencies
 RUN apt-get update \
@@ -69,7 +69,7 @@ RUN chisel_url=https://github.com/canonical/chisel/releases/download/${CHISEL_VE
     && curl -fSLOJ ${chisel_url} \
     && curl -fSL ${chisel_url}.sha384 | sha384sum -c - \
     && tar -xzf chisel_${CHISEL_VERSION}_linux_amd64.tar.gz -C /usr/bin/ chisel \
-    && curl -fSL --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${CHISEL_WRAPPER_VERSION}/chisel-wrapper \
+    && curl -fSL --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 ```
 

eng/dockerfile-templates/Dockerfile.linux.validate-checksum

@@ -23,6 +23,8 @@
                                 names separated by one or two spaces. One line must have a filename
                                 matching the file you wish to validate. See `man cksum` or
                                 `man sha512sum` for details.
+
+        stdin                 : Run sha check on standard input
         ^
 
     set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
@@ -35,7 +37,8 @@
             ARGS["sha"]))
 
 }}{{
-if (ARGS["sha"] || (ARGS["sha-file"] && ARGS["sha-file-is-bare"])):{{
+if (ARGS["stdin"]):sha{{ARGS["sha-function"]}}sum -c -^
+elif (ARGS["sha"] || (ARGS["sha-file"] && ARGS["sha-file-is-bare"])):{{
 if ARGS["sha-var-name"]:{{ARGS["sha-var-name"]}}='{{ARGS["sha"]}}' \
 && }}echo "{{shaValue}}  {{ARGS["file"]}}" | sha{{ARGS["sha-function"]}}sum -c -^
 elif (ARGS["file"]):{{

eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu

@@ -7,13 +7,14 @@
     set osVersionBase to match(OS_VERSION, ".+(?=.*-)")[0] ^
     set osVersionNumber to split(OS_ARCH_HYPHENATED, "-")[1] ^
 
-    set chiselUrl to VARIABLES[cat("chisel|", dotnetVersion, "|", ARCH_SHORT, "|url")] ^
-    set chiselFileName to "chisel.tar.gz" ^
+    set chiselVersion to VARIABLES[cat("chisel|", dotnetVersion, "|build-version")] ^
+    set chiselArch to
+        when(ARCH_SHORT = "arm32", "arm",
+        when(ARCH_SHORT = "x64", "amd64",
+             ARCH_SHORT)) ^
+    set chiselFile to cat("chisel_${CHISEL_VERSION}_linux_", chiselArch, ".tar.gz") ^
+    set rocksToolboxVersion to VARIABLES[cat("rocks-toolbox|", dotnetVersion, "|build-version")] ^
     set shaFunction to "384" ^
-    set chiselSha to VARIABLES[cat("chisel|", dotnetVersion, "|", ARCH_SHORT, "|sha", shaFunction)] ^
-    set rocksToolboxBaseUrl to VARIABLES[cat("rocks-toolbox|", dotnetVersion, "|url")] ^
-    set rocksToolboxRef to VARIABLES[cat("rocks-toolbox|", dotnetVersion, "|version")] ^
-    set rocksToolboxUrl to cat(rocksToolboxBaseUrl, "/", rocksToolboxRef, "/chisel-wrapper") ^
 
     set installerImageTag to cat(ARCH_VERSIONED, "/buildpack-deps:", osVersionBase, "-curl") ^
 
@@ -62,25 +63,29 @@
 
 }}FROM {{installerImageTag}} AS chisel
 
+# Find the latest chisel releases: https://github.com/canonical/chisel/releases
+ARG CHISEL_VERSION="{{chiselVersion}}"
+
+# Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
+ARG ROCKS_TOOLBOX_VERSION="{{rocksToolboxVersion}}"
+
 RUN apt-get update && apt-get install -y file
 
-RUN {{InsertTemplate("../Dockerfile.linux.download-files", ["files": [[
-        "url": chiselUrl,
-        "out-file": chiselFileName
+RUN chisel_url="https://github.com/canonical/chisel/releases/download/${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_linux_{{chiselArch}}.tar.gz" \
+    && {{InsertTemplate("../Dockerfile.linux.download-files", ["files": [[
+        "url": "${chisel_url}"
     ]]], "    ")}} \
-    && {{InsertTemplate("../Dockerfile.linux.validate-checksum", [
-        "file": chiselFileName,
-        "sha-function": shaFunction,
-        "sha": chiselSha,
-        "sha-var-name": cat("chisel_sha", shaFunction)
+    && curl --fail --show-error --location ${chisel_url}.sha{{shaFunction}} | {{InsertTemplate("../Dockerfile.linux.validate-checksum", [
+        "stdin": "true",
+        "sha-function": shaFunction
     ], "    ")}} \
     && {{InsertTemplate("../Dockerfile.linux.extract-file", [
-        "file": chiselFileName,
+        "file": chiselFile,
         "dest-dir": "/usr/bin/"
     ], "    ")}} \
-    && rm {{chiselFileName}} \
+    && rm {{chiselFile}} \
     && {{InsertTemplate("../Dockerfile.linux.download-files", ["files": [[
-        "url": rocksToolboxUrl,
+        "url": "https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper",
         "out-file": "/usr/bin/chisel-wrapper"
     ]]], "    ")}} \
     && chmod 755 /usr/bin/chisel-wrapper

manifest.versions.json

@@ -33,31 +33,9 @@
     "aspnet-composite|9.0|build-version": "$(aspnet|9.0|build-version)",
 
     "chisel|latest|build-version": "v1.3.0",
-    "chisel|latest|x64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_amd64.tar.gz",
-    "chisel|latest|arm|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_arm.tar.gz",
-    "chisel|latest|arm64|url": "https://github.com/canonical/chisel/releases/download/$(chisel|latest|build-version)/chisel_$(chisel|latest|build-version)_linux_arm64.tar.gz",
-    "chisel|10.0|x64|url": "$(chisel|latest|x64|url)",
-    "chisel|10.0|arm|url": "$(chisel|latest|arm|url)",
-    "chisel|10.0|arm64|url": "$(chisel|latest|arm64|url)",
-    "chisel|9.0|x64|url": "$(chisel|latest|x64|url)",
-    "chisel|9.0|arm|url": "$(chisel|latest|arm|url)",
-    "chisel|9.0|arm64|url": "$(chisel|latest|arm64|url)",
-    "chisel|8.0|x64|url": "$(chisel|latest|x64|url)",
-    "chisel|8.0|arm|url": "$(chisel|latest|arm|url)",
-    "chisel|8.0|arm64|url": "$(chisel|latest|arm64|url)",
-
-    "chisel|latest|x64|sha384": "8a5a6831251828fcd9ce8c9a47fca941d8763b7c80c16da784e2b1bf830ba606ab848f3886ce5945a3c2fc5e719c77e9",
-    "chisel|latest|arm|sha384": "fbfabeea4adabd7c3f7fc5b9bd09636200d68091ad3fa4cf901fd5567285b60fb0c8a4bc54e558bac3921ecf9679e7fb",
-    "chisel|latest|arm64|sha384": "5e5ae3083ecb59c314fbee290263ccc7417016798943fb533f01737918d38c35d21d683c5fe89e6fd3488af90ec7c83b",
-    "chisel|10.0|x64|sha384": "$(chisel|latest|x64|sha384)",
-    "chisel|10.0|arm|sha384": "$(chisel|latest|arm|sha384)",
-    "chisel|10.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
-    "chisel|9.0|x64|sha384": "$(chisel|latest|x64|sha384)",
-    "chisel|9.0|arm|sha384": "$(chisel|latest|arm|sha384)",
-    "chisel|9.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
-    "chisel|8.0|x64|sha384": "$(chisel|latest|x64|sha384)",
-    "chisel|8.0|arm|sha384": "$(chisel|latest|arm|sha384)",
-    "chisel|8.0|arm64|sha384": "$(chisel|latest|arm64|sha384)",
+    "chisel|10.0|build-version": "$(chisel|latest|build-version)",
+    "chisel|9.0|build-version": "$(chisel|latest|build-version)",
+    "chisel|8.0|build-version": "$(chisel|latest|build-version)",
 
     "dotnet|8.0|product-version": "8.0.21",
     "dotnet|8.0|fixed-tag": "$(dotnet|8.0|product-version)",
@@ -194,15 +172,10 @@
     "yarp|2.3|base-url|checksums|nightly": "$(base-url|public-checksums|preview|nightly)",
     "yarp|2.3|dotnet-version": "9.0",
 
-    "rocks-toolbox|latest|url": "https://raw.githubusercontent.com/canonical/rocks-toolbox",
-    "rocks-toolbox|8.0|url": "$(rocks-toolbox|latest|url)",
-    "rocks-toolbox|9.0|url": "$(rocks-toolbox|latest|url)",
-    "rocks-toolbox|10.0|url": "$(rocks-toolbox|latest|url)",
-
-    "rocks-toolbox|latest|version": "v1.2.0",
-    "rocks-toolbox|8.0|version": "$(rocks-toolbox|latest|version)",
-    "rocks-toolbox|9.0|version": "$(rocks-toolbox|latest|version)",
-    "rocks-toolbox|10.0|version": "$(rocks-toolbox|latest|version)",
+    "rocks-toolbox|latest|build-version": "v1.2.0",
+    "rocks-toolbox|8.0|build-version": "$(rocks-toolbox|latest|build-version)",
+    "rocks-toolbox|9.0|build-version": "$(rocks-toolbox|latest|build-version)",
+    "rocks-toolbox|10.0|build-version": "$(rocks-toolbox|latest|build-version)",
 
     "runtime|8.0|build-version": "8.0.21",
     "runtime|9.0|build-version": "9.0.10",

src/runtime-deps/10.0/noble-chiseled-extra/amd64/Dockerfile

@@ -1,13 +1,19 @@
 FROM amd64/buildpack-deps:noble-curl AS chisel
 
+# Find the latest chisel releases: https://github.com/canonical/chisel/releases
+ARG CHISEL_VERSION="v1.3.0"
+
+# Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
+ARG ROCKS_TOOLBOX_VERSION="v1.2.0"
+
 RUN apt-get update && apt-get install -y file
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.3.0/chisel_v1.3.0_linux_amd64.tar.gz \
-    && chisel_sha384='8a5a6831251828fcd9ce8c9a47fca941d8763b7c80c16da784e2b1bf830ba606ab848f3886ce5945a3c2fc5e719c77e9' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN chisel_url="https://github.com/canonical/chisel/releases/download/${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_linux_amd64.tar.gz" \
+    && curl --fail --show-error --location --remote-name ${chisel_url} \
+    && curl --fail --show-error --location ${chisel_url}.sha384 | sha384sum -c - \
+    && tar --gzip --extract --no-same-owner --file chisel_${CHISEL_VERSION}_linux_amd64.tar.gz --directory /usr/bin/ \
+    && rm chisel_${CHISEL_VERSION}_linux_amd64.tar.gz \
+    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \

src/runtime-deps/10.0/noble-chiseled-extra/arm32v7/Dockerfile

@@ -1,13 +1,19 @@
 FROM arm32v7/buildpack-deps:noble-curl AS chisel
 
+# Find the latest chisel releases: https://github.com/canonical/chisel/releases
+ARG CHISEL_VERSION="v1.3.0"
+
+# Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
+ARG ROCKS_TOOLBOX_VERSION="v1.2.0"
+
 RUN apt-get update && apt-get install -y file
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.3.0/chisel_v1.3.0_linux_arm.tar.gz \
-    && chisel_sha384='fbfabeea4adabd7c3f7fc5b9bd09636200d68091ad3fa4cf901fd5567285b60fb0c8a4bc54e558bac3921ecf9679e7fb' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN chisel_url="https://github.com/canonical/chisel/releases/download/${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_linux_arm.tar.gz" \
+    && curl --fail --show-error --location --remote-name ${chisel_url} \
+    && curl --fail --show-error --location ${chisel_url}.sha384 | sha384sum -c - \
+    && tar --gzip --extract --no-same-owner --file chisel_${CHISEL_VERSION}_linux_arm.tar.gz --directory /usr/bin/ \
+    && rm chisel_${CHISEL_VERSION}_linux_arm.tar.gz \
+    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \

src/runtime-deps/10.0/noble-chiseled-extra/arm64v8/Dockerfile

@@ -1,13 +1,19 @@
 FROM arm64v8/buildpack-deps:noble-curl AS chisel
 
+# Find the latest chisel releases: https://github.com/canonical/chisel/releases
+ARG CHISEL_VERSION="v1.3.0"
+
+# Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
+ARG ROCKS_TOOLBOX_VERSION="v1.2.0"
+
 RUN apt-get update && apt-get install -y file
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.3.0/chisel_v1.3.0_linux_arm64.tar.gz \
-    && chisel_sha384='5e5ae3083ecb59c314fbee290263ccc7417016798943fb533f01737918d38c35d21d683c5fe89e6fd3488af90ec7c83b' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN chisel_url="https://github.com/canonical/chisel/releases/download/${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_linux_arm64.tar.gz" \
+    && curl --fail --show-error --location --remote-name ${chisel_url} \
+    && curl --fail --show-error --location ${chisel_url}.sha384 | sha384sum -c - \
+    && tar --gzip --extract --no-same-owner --file chisel_${CHISEL_VERSION}_linux_arm64.tar.gz --directory /usr/bin/ \
+    && rm chisel_${CHISEL_VERSION}_linux_arm64.tar.gz \
+    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \

src/runtime-deps/10.0/noble-chiseled/amd64/Dockerfile

@@ -1,13 +1,19 @@
 FROM amd64/buildpack-deps:noble-curl AS chisel
 
+# Find the latest chisel releases: https://github.com/canonical/chisel/releases
+ARG CHISEL_VERSION="v1.3.0"
+
+# Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
+ARG ROCKS_TOOLBOX_VERSION="v1.2.0"
+
 RUN apt-get update && apt-get install -y file
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.3.0/chisel_v1.3.0_linux_amd64.tar.gz \
-    && chisel_sha384='8a5a6831251828fcd9ce8c9a47fca941d8763b7c80c16da784e2b1bf830ba606ab848f3886ce5945a3c2fc5e719c77e9' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN chisel_url="https://github.com/canonical/chisel/releases/download/${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_linux_amd64.tar.gz" \
+    && curl --fail --show-error --location --remote-name ${chisel_url} \
+    && curl --fail --show-error --location ${chisel_url}.sha384 | sha384sum -c - \
+    && tar --gzip --extract --no-same-owner --file chisel_${CHISEL_VERSION}_linux_amd64.tar.gz --directory /usr/bin/ \
+    && rm chisel_${CHISEL_VERSION}_linux_amd64.tar.gz \
+    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \

src/runtime-deps/10.0/noble-chiseled/arm32v7/Dockerfile

@@ -1,13 +1,19 @@
 FROM arm32v7/buildpack-deps:noble-curl AS chisel
 
+# Find the latest chisel releases: https://github.com/canonical/chisel/releases
+ARG CHISEL_VERSION="v1.3.0"
+
+# Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
+ARG ROCKS_TOOLBOX_VERSION="v1.2.0"
+
 RUN apt-get update && apt-get install -y file
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.3.0/chisel_v1.3.0_linux_arm.tar.gz \
-    && chisel_sha384='fbfabeea4adabd7c3f7fc5b9bd09636200d68091ad3fa4cf901fd5567285b60fb0c8a4bc54e558bac3921ecf9679e7fb' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN chisel_url="https://github.com/canonical/chisel/releases/download/${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_linux_arm.tar.gz" \
+    && curl --fail --show-error --location --remote-name ${chisel_url} \
+    && curl --fail --show-error --location ${chisel_url}.sha384 | sha384sum -c - \
+    && tar --gzip --extract --no-same-owner --file chisel_${CHISEL_VERSION}_linux_arm.tar.gz --directory /usr/bin/ \
+    && rm chisel_${CHISEL_VERSION}_linux_arm.tar.gz \
+    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \

src/runtime-deps/10.0/noble-chiseled/arm64v8/Dockerfile

@@ -1,13 +1,19 @@
 FROM arm64v8/buildpack-deps:noble-curl AS chisel
 
+# Find the latest chisel releases: https://github.com/canonical/chisel/releases
+ARG CHISEL_VERSION="v1.3.0"
+
+# Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
+ARG ROCKS_TOOLBOX_VERSION="v1.2.0"
+
 RUN apt-get update && apt-get install -y file
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.3.0/chisel_v1.3.0_linux_arm64.tar.gz \
-    && chisel_sha384='5e5ae3083ecb59c314fbee290263ccc7417016798943fb533f01737918d38c35d21d683c5fe89e6fd3488af90ec7c83b' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN chisel_url="https://github.com/canonical/chisel/releases/download/${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_linux_arm64.tar.gz" \
+    && curl --fail --show-error --location --remote-name ${chisel_url} \
+    && curl --fail --show-error --location ${chisel_url}.sha384 | sha384sum -c - \
+    && tar --gzip --extract --no-same-owner --file chisel_${CHISEL_VERSION}_linux_arm64.tar.gz --directory /usr/bin/ \
+    && rm chisel_${CHISEL_VERSION}_linux_arm64.tar.gz \
+    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \

src/runtime-deps/8.0/jammy-chiseled-extra/amd64/Dockerfile

@@ -1,13 +1,19 @@
 FROM amd64/buildpack-deps:jammy-curl AS chisel
 
+# Find the latest chisel releases: https://github.com/canonical/chisel/releases
+ARG CHISEL_VERSION="v1.3.0"
+
+# Find the latest chisel-wrapper releases: https://github.com/canonical/rocks-toolbox/releases
+ARG ROCKS_TOOLBOX_VERSION="v1.2.0"
+
 RUN apt-get update && apt-get install -y file
 
-RUN curl --fail --show-error --location --output chisel.tar.gz https://github.com/canonical/chisel/releases/download/v1.3.0/chisel_v1.3.0_linux_amd64.tar.gz \
-    && chisel_sha384='8a5a6831251828fcd9ce8c9a47fca941d8763b7c80c16da784e2b1bf830ba606ab848f3886ce5945a3c2fc5e719c77e9' \
-    && echo "$chisel_sha384  chisel.tar.gz" | sha384sum -c - \
-    && tar --gzip --extract --no-same-owner --file chisel.tar.gz --directory /usr/bin/ \
-    && rm chisel.tar.gz \
-    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/v1.2.0/chisel-wrapper \
+RUN chisel_url="https://github.com/canonical/chisel/releases/download/${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_linux_amd64.tar.gz" \
+    && curl --fail --show-error --location --remote-name ${chisel_url} \
+    && curl --fail --show-error --location ${chisel_url}.sha384 | sha384sum -c - \
+    && tar --gzip --extract --no-same-owner --file chisel_${CHISEL_VERSION}_linux_amd64.tar.gz --directory /usr/bin/ \
+    && rm chisel_${CHISEL_VERSION}_linux_amd64.tar.gz \
+    && curl --fail --show-error --location --output /usr/bin/chisel-wrapper https://raw.githubusercontent.com/canonical/rocks-toolbox/${ROCKS_TOOLBOX_VERSION}/chisel-wrapper \
     && chmod 755 /usr/bin/chisel-wrapper
 
 RUN groupadd \