[PATCH 2/3] scripts: Use ftpmirror in build-many-glibcs.py

[Carlos O'Donell]

On 11/12/25 6:45 AM, Yury Khrustalev wrote:
> Use recommended ftpmirror URLs to download tarballs
> ---
>   scripts/build-many-glibcs.py | 16 ++++++++--------
>   1 file changed, 8 insertions(+), 8 deletions(-)

LGTM.

Reviewed-by: Carlos O'Donell <carlos@redhat.com> 
> diff --git a/scripts/build-many-glibcs.py b/scripts/build-many-glibcs.py
> index 67fe279d6c..811b23ecdf 100755
> --- a/scripts/build-many-glibcs.py
> +++ b/scripts/build-many-glibcs.py
> @@ -1019,15 +1019,15 @@ class Context(object):
>           tarball."""
>           if update:
>               return
> -        url_map = {'binutils': 'https://ftp.gnu.org/gnu/binutils/binutils-%(version)s.tar.bz2',
> -                   'gcc': 'https://ftp.gnu.org/gnu/gcc/gcc-%(version)s/gcc-%(version)s.tar.gz',
> -                   'gmp': 'https://ftp.gnu.org/gnu/gmp/gmp-%(version)s.tar.xz',
> +        url_map = {'binutils': 'https://ftpmirror.gnu.org/gnu/binutils/binutils-%(version)s.tar.bz2',
> +                   'gcc': 'https://ftpmirror.gnu.org/gnu/gcc/gcc-%(version)s/gcc-%(version)s.tar.gz',
> +                   'gmp': 'https://ftpmirror.gnu.org/gnu/gmp/gmp-%(version)s.tar.xz',
>                      'linux': 'https://www.kernel.org/pub/linux/kernel/v%(major)s.x/linux-%(version)s.tar.xz',
> -                   'mpc': 'https://ftp.gnu.org/gnu/mpc/mpc-%(version)s.tar.gz',
> -                   'mpfr': 'https://ftp.gnu.org/gnu/mpfr/mpfr-%(version)s.tar.xz',
> -                   'mig': 'https://ftp.gnu.org/gnu/mig/mig-%(version)s.tar.bz2',
> -                   'gnumach': 'https://ftp.gnu.org/gnu/gnumach/gnumach-%(version)s.tar.bz2',
> -                   'hurd': 'https://ftp.gnu.org/gnu/hurd/hurd-%(version)s.tar.bz2'}
> +                   'mpc': 'https://ftpmirror.gnu.org/gnu/mpc/mpc-%(version)s.tar.gz',
> +                   'mpfr': 'https://ftpmirror.gnu.org/gnu/mpfr/mpfr-%(version)s.tar.xz',
> +                   'mig': 'https://ftpmirror.gnu.org/gnu/mig/mig-%(version)s.tar.bz2',
> +                   'gnumach': 'https://ftpmirror.gnu.org/gnu/gnumach/gnumach-%(version)s.tar.bz2',
> +                   'hurd': 'https://ftpmirror.gnu.org/gnu/hurd/hurd-%(version)s.tar.bz2'}
>           if component not in url_map:
>               print('error: component %s coming from tarball' % component)
>               exit(1)

This changes our SSDLC posture slightly in that we are now fetching
sources from mirrors rather than the authoritative source.

I don't object, but I'm just calling out that what we would really like
in this scenario is a mechanism for attesting that these downloaded
tarballs are actually what we expect e.g. sigstore etc.

I wonder if we can't get a light-weight cross check?

(1) Download the 310 byte signature from ftp.gnu.org.
(2) Cross check the signature validates for ftpmirror.gnu.org

Thoughts?

-- 
Cheers,
Carlos.