[PATCH 2/3] scripts: Use ftpmirror in build-many-glibcs.py

[Carlos O'Donell]

On 11/12/25 2:08 PM, Joseph Myers wrote:
> On Wed, 12 Nov 2025, Carlos O'Donell wrote:
> 
>> I don't object, but I'm just calling out that what we would really like
>> in this scenario is a mechanism for attesting that these downloaded
>> tarballs are actually what we expect e.g. sigstore etc.
>>
>> I wonder if we can't get a light-weight cross check?
>>
>> (1) Download the 310 byte signature from ftp.gnu.org.
>> (2) Cross check the signature validates for ftpmirror.gnu.org
>>
>> Thoughts?
> 
> How about hardcoding an SHA256 (for example) checksum alongside the
> version number for everything where we use a tarball, and making the
> script check that?  That seems a fairly common approach for systems that
> download a tarball and expect it to have particular contents.  (We'd need
> to work out what to do when a user overrides the version number for such a
> component on the command line.)

That works for me.

-- 
Cheers,
Carlos.