[PATCH 2/3] scripts: Use ftpmirror in build-many-glibcs.py

[Collin Funk]

Yury Khrustalev <yury.khrustalev@arm.com> writes:

> On Wed, Nov 12, 2025 at 09:04:40AM -0500, Carlos O'Donell wrote:
>> On 11/12/25 6:45 AM, Yury Khrustalev wrote:
>> > Use recommended ftpmirror URLs to download tarballs
>> > ---
>> >   scripts/build-many-glibcs.py | 16 ++++++++--------
>> >   1 file changed, 8 insertions(+), 8 deletions(-)
>> 
>> ...
>> 
>> This changes our SSDLC posture slightly in that we are now fetching
>> sources from mirrors rather than the authoritative source.
>> 
>> I don't object, but I'm just calling out that what we would really like
>> in this scenario is a mechanism for attesting that these downloaded
>> tarballs are actually what we expect e.g. sigstore etc.
>> 
>> I wonder if we can't get a light-weight cross check?
>> 
>> (1) Download the 310 byte signature from ftp.gnu.org.
>> (2) Cross check the signature validates for ftpmirror.gnu.org
>> 
>> Thoughts?
>>
>
> Use of ftpmirror URLs is recommended on https://www.gnu.org/prep/ftp.html
> so we should be OK to follow this advice?
>
> If we try to access ftp.gnu.org instead, we'd have the same timeout
> issue that I'm trying to solve. Even
>
>   curl -I https://ftp.gnu.org/
>
> times out.
>
> We could use env variables to provide alternative URLs so that users
> like me could use ftpmirror?

Sometimes ftpmirror.gnu.org can link to stale/offline mirrors, as was
previously mentioned in bug-gnulib [1].

It might be better to allow someone to choose a mirror that they trust.
I probably owe UC Berkeley money since I use theirs every time.

Collin

[1] https://lists.gnu.org/archive/html/bug-gnulib/2025-02/msg00033.html