From 88f97496bedfee07529657b12f3233e851a1c45f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mika=C3=ABl=20Cluseau?= <mikael.cluseau@gmail.com>
Date: Fri, 17 Jul 2026 13:10:07 +0200
Subject: [PATCH] add X-Content-SHA1 when fetching dist

---
 cmd/dkl-local-server/upstream.go | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/cmd/dkl-local-server/upstream.go b/cmd/dkl-local-server/upstream.go
index 0abf486..332ad09 100644
--- a/cmd/dkl-local-server/upstream.go
+++ b/cmd/dkl-local-server/upstream.go
@@ -35,7 +35,30 @@ func (_ upstreamServer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	http.ServeFile(w, req, outPath)
+	f, err := os.Open(outPath)
+	if err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(err.Error() + "\n"))
+		return
+	}
+	defer f.Close()
+
+	h := sha1.New()
+	if _, err := io.Copy(h, f); err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(err.Error() + "\n"))
+		return
+	}
+	sha1Hex := hex.EncodeToString(h.Sum(nil))
+	w.Header().Set("X-Content-SHA1", sha1Hex)
+
+	if _, err := f.Seek(0, 0); err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(err.Error() + "\n"))
+		return
+	}
+
+	http.ServeContent(w, req, outPath, time.Time{}, f)
 }
 
 func distFetch(path ...string) (outPath string, err error) {