CI: log downloaded file hashes, pin manually bumped ones

To ensure downloaded binaries are the expected ones. Also to document
SHA-256 hashes of all binary packages and source tarballs.

Closes #20517
This commit is contained in:
Viktor Szakats 2026-02-04 14:54:26 +01:00
parent 462244447e
commit 4ad0a022e1
No known key found for this signature in database
9 changed files with 87 additions and 58 deletions

View file

@ -359,14 +359,15 @@ jobs:
run: |
cd ~
curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 --retry-connrefused \
--location "https://github.com/andrewwutw/build-djgpp/releases/download/v${TOOLCHAIN_VERSION}/djgpp-linux64-gcc1220.tar.bz2" | tar -xj
--location "https://github.com/andrewwutw/build-djgpp/releases/download/v${TOOLCHAIN_VERSION}/djgpp-linux64-gcc1220.tar.bz2" --output pkg.bin
sha256sum pkg.bin && tar -xjf pkg.bin && rm -f pkg.bin
cd djgpp
for f in wat3211b.zip zlb13b.zip; do
curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
"https://www.delorie.com/pub/djgpp/current/v2tk/$f" --output bin.zip
unzip -q bin.zip
rm -f bin.zip
done
curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
https://www.delorie.com/pub/djgpp/current/v2tk/wat3211b.zip --output pkg.bin
sha256sum pkg.bin | tee /dev/stderr | grep -qwF faa2222ab5deb2c2aac229c760bf4d45aca5379f5af97865c308a0467046b67a && unzip -q pkg.bin && rm -f pkg.bin
curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
https://www.delorie.com/pub/djgpp/current/v2tk/zlb13b.zip --output pkg.bin
sha256sum pkg.bin | tee /dev/stderr | grep -qwF f3d2fa8129e7591c7e79074306d8ab91a70ec172cc01baedeae74992285dd3a3 && unzip -q pkg.bin && rm -f pkg.bin
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with: