mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-12 01:27:32 +00:00
Johnathan Corgan
ffc1f8cf23
The OpenWrt cross-compile fetched zig through `curl | sudo tar xJ`, so a short read reached tar as a truncated archive and failed the build with "Unexpected EOF in archive". A pipe leaves nowhere to check the bytes, and curl's own --retry does not cover it: exit 18 is not in its transient set. Download to a staging directory first, verify a pinned SHA-256, then extract. Each architecture now sets its hash on the same case branch that sets its name, so an architecture cannot be added without one, and a guard fails with the jq recipe for deriving it if the hash is ever empty. Three attempts with 10s and 20s backoff, matching the retry idiom already in this workflow, and an early exit when two attempts return identical bytes, since a stable mismatch is a wrong pin rather than a bad transfer. The step also gains `set -euo pipefail` and a trap that removes the staging directory on every exit path. It previously ran under the default shell without pipefail, so a failure inside the pipe could be masked by tar. The hashes come from ziglang.org's download index and were checked against the bytes of both tarballs. That is integrity, not authenticity: index and archive share an origin, and upstream publishes no detached sums.