From ac9785fabb4fa5d0282bc130a7e9803626806502 Mon Sep 17 00:00:00 2001
From: Christian Schwarz <me@cschwarz.com>
Date: Thu, 22 Jan 2026 00:26:20 +0000
Subject: [PATCH] protoc: safer pinning

---
 build/get_protoc.bash | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/build/get_protoc.bash b/build/get_protoc.bash
index 6e97849..dad3e89 100644
--- a/build/get_protoc.bash
+++ b/build/get_protoc.bash
@@ -19,9 +19,14 @@ wget --continue https://github.com/protocolbuffers/protobuf/releases/download/v"
 
 stat "$FILENAME"
 
-sha256sum -c --ignore-missing <<EOF
-d622619dcbfb5ecb281cfb92c1a74d6a0f42e752d9a2774b197f475f7ab1c8c4  protoc-28.0-linux-aarch_64.zip
-b2e187c8b9f2d97cd3ecae4926d1bb2cbebe3ab768e7c987cbc86bb17f319358  protoc-28.0-linux-x86_64.zip
-EOF
+# Select the correct checksum for the downloaded architecture
+case "$MACH" in
+    aarch_64) EXPECTED_SHA256="d622619dcbfb5ecb281cfb92c1a74d6a0f42e752d9a2774b197f475f7ab1c8c4" ;;
+    x86_64)   EXPECTED_SHA256="b2e187c8b9f2d97cd3ecae4926d1bb2cbebe3ab768e7c987cbc86bb17f319358" ;;
+    *)        echo "Unknown architecture: $MACH" >&2; exit 1 ;;
+esac
+
+# Verify checksum explicitly - fails if hash doesn't match
+echo "$EXPECTED_SHA256  $FILENAME" | sha256sum -c -
 
 unzip -d . "$FILENAME"