zlib.net answers 200 with a spinner page, and only the sha256 says so

Its anti-bot interstitial serves a 12KB HTML page under the tarball's URL.
curl -f accepts it -- it is a 200 -- so the download "succeeds" and the
failure surfaces one step later as a checksum mismatch, which is the
report reserved for a tampered file. Nobody bumping a pin should have to
rule out an attack first.

madler publishes the release as a GitHub asset, and it is byte-identical:
sha256 9a93b2b7...df23, the pin already in versions.env, unchanged.
tools/python/build.sh fetched the same file from the same host and moves
with it, so neither path is left on the URL that lies.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0149y4iyLpEwYKh2PS4fmf4u

tools/python/build.sh

@@ -136,7 +136,7 @@ fetch() {  # fetch <url>  -> $SRC/<basename>, cached
 }
 log "fetch sources"
 fetch https://www.python.org/ftp/python/$PY_VER/Python-$PY_VER.tgz
-fetch https://zlib.net/fossils/zlib-$ZLIB_VER.tar.gz
+fetch https://github.com/madler/zlib/releases/download/v$ZLIB_VER/zlib-$ZLIB_VER.tar.gz
 fetch https://github.com/openssl/openssl/releases/download/openssl-$OSSL_VER/openssl-$OSSL_VER.tar.gz
 fetch https://github.com/libffi/libffi/releases/download/v$FFI_VER/libffi-$FFI_VER.tar.gz
 fetch https://www.sqlite.org/2024/$SQLITE_TAR.tar.gz