From fd258eadf7768b4f46f178b8a49beef818bbcde6 Mon Sep 17 00:00:00 2001 From: Oleksandr Shyshatskyi Date: Sun, 30 Aug 2026 16:12:48 +0300 Subject: [PATCH] zlib.net answers 200 with a spinner page, and only the sha256 says so Its anti-bot interstitial serves a 12KB HTML page under the tarball's URL. curl -f accepts it -- it is a 200 -- so the download "succeeds" and the failure surfaces one step later as a checksum mismatch, which is the report reserved for a tampered file. Nobody bumping a pin should have to rule out an attack first. madler publishes the release as a GitHub asset, and it is byte-identical: sha256 9a93b2b7...df23, the pin already in versions.env, unchanged. tools/python/build.sh fetched the same file from the same host and moves with it, so neither path is left on the URL that lies. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0149y4iyLpEwYKh2PS4fmf4u --- bin/fetch-assets.sh | 8 +++++--- tools/python/build.sh | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/bin/fetch-assets.sh b/bin/fetch-assets.sh index c8101ef..97f1f88 100755 --- a/bin/fetch-assets.sh +++ b/bin/fetch-assets.sh @@ -102,9 +102,11 @@ get "https://github.com/openssl/openssl/releases/download/openssl-$OPENSSL_VERSI # in the version number -- hence SQLITE_YEAR. get "https://www.sqlite.org/$SQLITE_YEAR/sqlite-autoconf-$SQLITE_VERSION.tar.gz" \ "$SQLITE_TGZ" "$SQLITE_SHA256" -# /fossils/, not the front page: zlib.net moves a release there the moment it -# is superseded, and the front-page URL then 404s for a good pin. -get "https://zlib.net/fossils/zlib-$ZLIB_VERSION.tar.gz" \ +# madler's own release asset, not zlib.net: that host sits behind an anti-bot +# interstitial that answers 200 with a 12KB HTML spinner page, which curl -f +# accepts and only the sha256 rejects -- as a mismatch that reads like +# tampering. The GitHub asset is byte-identical to the pin below. +get "https://github.com/madler/zlib/releases/download/v$ZLIB_VERSION/zlib-$ZLIB_VERSION.tar.gz" \ "$ZLIB_TGZ" "$ZLIB_SHA256" get "https://github.com/libffi/libffi/releases/download/v$LIBFFI_VERSION/libffi-$LIBFFI_VERSION.tar.gz" \ "$LIBFFI_TGZ" "$LIBFFI_SHA256" diff --git a/tools/python/build.sh b/tools/python/build.sh index 791b6f1..560476f 100755 --- a/tools/python/build.sh +++ b/tools/python/build.sh @@ -136,7 +136,7 @@ fetch() { # fetch -> $SRC/, cached } log "fetch sources" fetch https://www.python.org/ftp/python/$PY_VER/Python-$PY_VER.tgz -fetch https://zlib.net/fossils/zlib-$ZLIB_VER.tar.gz +fetch https://github.com/madler/zlib/releases/download/v$ZLIB_VER/zlib-$ZLIB_VER.tar.gz fetch https://github.com/openssl/openssl/releases/download/openssl-$OSSL_VER/openssl-$OSSL_VER.tar.gz fetch https://github.com/libffi/libffi/releases/download/v$FFI_VER/libffi-$FFI_VER.tar.gz fetch https://www.sqlite.org/2024/$SQLITE_TAR.tar.gz