[PATCH 2/3] scripts: Use ftpmirror in build-many-glibcs.py

[Yury Khrustalev]

On Wed, Nov 12, 2025 at 03:53:08PM -0500, Carlos O'Donell wrote:
> On 11/12/25 2:08 PM, Joseph Myers wrote:
> > On Wed, 12 Nov 2025, Carlos O'Donell wrote:
> > 
> > > I don't object, but I'm just calling out that what we would really like
> > > in this scenario is a mechanism for attesting that these downloaded
> > > tarballs are actually what we expect e.g. sigstore etc.
> > > 
> > > I wonder if we can't get a light-weight cross check?
> > > 
> > > (1) Download the 310 byte signature from ftp.gnu.org.
> > > (2) Cross check the signature validates for ftpmirror.gnu.org
> > > 
> > > Thoughts?
> > 
> > How about hardcoding an SHA256 (for example) checksum alongside the
> > version number for everything where we use a tarball, and making the
> > script check that?  That seems a fairly common approach for systems that
> > download a tarball and expect it to have particular contents.  (We'd need
> > to work out what to do when a user overrides the version number for such a
> > component on the command line.)
> 
> That works for me.

I like the idea of hard-coding checksums, however updating logic around
overriding versions via command line goes beyond what I can do right
now, so I'll have to keep this change downstream.

Thanks,
Yury