fix: finish 2.9.0 plugin moves and get every check green

plugins/opkssh/package.json

@@ -6,7 +6,7 @@
   "scripts": {
     "build": "termix-plugin build",
     "test": "termix-plugin test",
-    "typecheck": "tsc -p tsconfig.json",
+    "typecheck": "tsc -b ../../tsconfig.plugins.json ../../tsconfig.plugins.frontend.json",
     "validate": "termix-plugin validate"
   },
   "dependencies": {

plugins/opkssh/src/backend/binary.ts

@@ -43,7 +43,8 @@ export function binaryName(
  * What ctx.process.ensureBinary needs for OPKSSH.
  *
  * The pinned version is trusted by its built-in checksums. OPKSSH_VERSION
- * picks another release, and then OPKSSH_SHA256 must give its checksum.
+ * picks another release, and then OPKSSH_SHA256 (or OPKSSH_SHA256_AMD64 /
+ * OPKSSH_SHA256_ARM64, which the Docker image passes on) gives its checksum.
  *
  * The Docker image bakes the binary into /app/opkssh-bundled (the
  * opkssh-downloader stage), which is checked first so an offline install
@@ -60,7 +61,12 @@ export function binarySpec(
   const sha256 =
     version === DEFAULT_VERSION
       ? DEFAULT_CHECKSUMS[name]
-      : env.OPKSSH_SHA256?.trim().toLowerCase();
+      : (
+          env.OPKSSH_SHA256 ||
+          env[`OPKSSH_SHA256_${arch === "arm64" ? "ARM64" : "AMD64"}`]
+        )
+          ?.trim()
+          .toLowerCase();
   if (!sha256 || !/^[0-9a-f]{64}$/.test(sha256)) {
     throw new Error(
       `OPKSSH ${version} has no trusted SHA-256 checksum for ${name}`,

plugins/opkssh/tests/backend/helpers-pure.test.ts

@@ -107,4 +107,16 @@ describe("binary", () => {
       binarySpec({ OPKSSH_VERSION: "v9", OPKSSH_SHA256: sha }, "linux", "x64"),
     ).toMatchObject({ version: "v9", sha256: sha });
   });
+
+  it("reads the per-architecture checksum the Docker image passes on", () => {
+    const amd = "b".repeat(64);
+    const arm = "c".repeat(64);
+    const env = {
+      OPKSSH_VERSION: "v9",
+      OPKSSH_SHA256_AMD64: amd,
+      OPKSSH_SHA256_ARM64: arm,
+    };
+    expect(binarySpec(env, "linux", "x64").sha256).toBe(amd);
+    expect(binarySpec(env, "linux", "arm64").sha256).toBe(arm);
+  });
 });