[PATCH 2/3] scripts: Use ftpmirror in build-many-glibcs.py

[Yury Khrustalev]

On Wed, Nov 12, 2025 at 09:04:40AM -0500, Carlos O'Donell wrote:
> On 11/12/25 6:45 AM, Yury Khrustalev wrote:
> > Use recommended ftpmirror URLs to download tarballs
> > ---
> >   scripts/build-many-glibcs.py | 16 ++++++++--------
> >   1 file changed, 8 insertions(+), 8 deletions(-)
> 
> ...
> 
> This changes our SSDLC posture slightly in that we are now fetching
> sources from mirrors rather than the authoritative source.
> 
> I don't object, but I'm just calling out that what we would really like
> in this scenario is a mechanism for attesting that these downloaded
> tarballs are actually what we expect e.g. sigstore etc.
> 
> I wonder if we can't get a light-weight cross check?
> 
> (1) Download the 310 byte signature from ftp.gnu.org.
> (2) Cross check the signature validates for ftpmirror.gnu.org
> 
> Thoughts?
>

Use of ftpmirror URLs is recommended on https://www.gnu.org/prep/ftp.html
so we should be OK to follow this advice?

If we try to access ftp.gnu.org instead, we'd have the same timeout
issue that I'm trying to solve. Even

  curl -I https://ftp.gnu.org/

times out.

We could use env variables to provide alternative URLs so that users
like me could use ftpmirror?

Thanks,
Yury