base: bun-distrust leaves the binary alone when there's nothing to replace

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 4 insertions, 2 deletions

diff --git a/docker/bun-distrust.ts b/docker/bun-distrust.ts
index 3b324caf..5137883a 100644
--- a/docker/bun-distrust.ts
+++ b/docker/bun-distrust.ts
@@ -14,7 +14,8 @@ const distrust = {
 };
 
 const bin = process.argv[2];
-let buf = readFileSync(bin);
+const buf = readFileSync(bin);
+let patched = false;
 
 for (const [cn, placeholder] of Object.entries(distrust)) {
   const pem = getCACertificates("bundled").find(
@@ -32,7 +33,8 @@ for (const [cn, placeholder] of Object.entries(distrust)) {
   if (at < 0 || buf.indexOf(der, at + 1) >= 0)
     throw new Error(`${cn}: expected exactly one copy in ${bin}`);
   repl.copy(buf, at);
+  patched = true;
   console.log(`${cn}: replaced at offset ${at}`);
 }
 
-writeFileSync(bin, buf);
+if (patched) writeFileSync(bin, buf);