zlib.net answers 200 with a spinner page, and only the sha256 says so

Its anti-bot interstitial serves a 12KB HTML page under the tarball's URL.
curl -f accepts it -- it is a 200 -- so the download "succeeds" and the
failure surfaces one step later as a checksum mismatch, which is the
report reserved for a tampered file. Nobody bumping a pin should have to
rule out an attack first.

madler publishes the release as a GitHub asset, and it is byte-identical:
sha256 9a93b2b7...df23, the pin already in versions.env, unchanged.
tools/python/build.sh fetched the same file from the same host and moves
with it, so neither path is left on the URL that lies.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0149y4iyLpEwYKh2PS4fmf4u

bin/fetch-assets.sh

@@ -102,9 +102,11 @@ get "https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSI
 # in the version number -- hence SQLITE_YEAR.
 get "https://www.sqlite.org/$SQLITE_YEAR/sqlite-autoconf-$SQLITE_VERSION.tar.gz" \
     "$SQLITE_TGZ" "$SQLITE_SHA256"
-# /fossils/, not the front page: zlib.net moves a release there the moment it
-# is superseded, and the front-page URL then 404s for a good pin.
-get "https://zlib.net/fossils/zlib-$ZLIB_VERSION.tar.gz" \
+# madler's own release asset, not zlib.net: that host sits behind an anti-bot
+# interstitial that answers 200 with a 12KB HTML spinner page, which curl -f
+# accepts and only the sha256 rejects -- as a mismatch that reads like
+# tampering. The GitHub asset is byte-identical to the pin below.
+get "https://github.com/madler/zlib/releases/download/v$ZLIB_VERSION/zlib-$ZLIB_VERSION.tar.gz" \
     "$ZLIB_TGZ" "$ZLIB_SHA256"
 get "https://github.com/libffi/libffi/releases/download/v$LIBFFI_VERSION/libffi-$LIBFFI_VERSION.tar.gz" \
     "$LIBFFI_TGZ" "$LIBFFI_SHA256"

tools/python/build.sh

@@ -136,7 +136,7 @@ fetch() {  # fetch <url>  -> $SRC/<basename>, cached
 }
 log "fetch sources"
 fetch https://www.python.org/ftp/python/$PY_VER/Python-$PY_VER.tgz
-fetch https://zlib.net/fossils/zlib-$ZLIB_VER.tar.gz
+fetch https://github.com/madler/zlib/releases/download/v$ZLIB_VER/zlib-$ZLIB_VER.tar.gz
 fetch https://github.com/openssl/openssl/releases/download/openssl-$OSSL_VER/openssl-$OSSL_VER.tar.gz
 fetch https://github.com/libffi/libffi/releases/download/v$FFI_VER/libffi-$FFI_VER.tar.gz
 fetch https://www.sqlite.org/2024/$SQLITE_TAR.tar.gz