From d84a2c8c21124cfc3326ae8b4dd1f6afeb5fde6d Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Wed, 21 Oct 2026 05:58:33 -0700
Subject: base: bun-distrust leaves the binary alone when there's nothing to
 replace

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docker/bun-distrust.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'docker')

diff --git a/docker/bun-distrust.ts b/docker/bun-distrust.ts
index 3b324caf..5137883a 100644
--- a/docker/bun-distrust.ts
+++ b/docker/bun-distrust.ts
@@ -14,7 +14,8 @@ const distrust = {
 };
 
 const bin = process.argv[2];
-let buf = readFileSync(bin);
+const buf = readFileSync(bin);
+let patched = false;
 
 for (const [cn, placeholder] of Object.entries(distrust)) {
   const pem = getCACertificates("bundled").find(
@@ -32,7 +33,8 @@ for (const [cn, placeholder] of Object.entries(distrust)) {
   if (at < 0 || buf.indexOf(der, at + 1) >= 0)
     throw new Error(`${cn}: expected exactly one copy in ${bin}`);
   repl.copy(buf, at);
+  patched = true;
   console.log(`${cn}: replaced at offset ${at}`);
 }
 
-writeFileSync(bin, buf);
+if (patched) writeFileSync(bin, buf);
-- 
cgit v1.2.3