[PATCH 2/3] scripts: Use ftpmirror in build-many-glibcs.py

[Joseph Myers]

On Wed, 12 Nov 2025, Carlos O'Donell wrote:

> I don't object, but I'm just calling out that what we would really like
> in this scenario is a mechanism for attesting that these downloaded
> tarballs are actually what we expect e.g. sigstore etc.
> 
> I wonder if we can't get a light-weight cross check?
> 
> (1) Download the 310 byte signature from ftp.gnu.org.
> (2) Cross check the signature validates for ftpmirror.gnu.org
> 
> Thoughts?

How about hardcoding an SHA256 (for example) checksum alongside the 
version number for everything where we use a tarball, and making the 
script check that?  That seems a fairly common approach for systems that 
download a tarball and expect it to have particular contents.  (We'd need 
to work out what to do when a user overrides the version number for such a 
component on the command line.)

-- 
Joseph S. Myers
josmyers@redhat.com