protoc: safer pinning

This commit is contained in:
Christian Schwarz
2026-01-22 00:26:20 +00:00
parent 899e23762a
commit ac9785fabb
+9 -4
View File
@@ -19,9 +19,14 @@ wget --continue https://github.com/protocolbuffers/protobuf/releases/download/v"
stat "$FILENAME"
sha256sum -c --ignore-missing <<EOF
d622619dcbfb5ecb281cfb92c1a74d6a0f42e752d9a2774b197f475f7ab1c8c4 protoc-28.0-linux-aarch_64.zip
b2e187c8b9f2d97cd3ecae4926d1bb2cbebe3ab768e7c987cbc86bb17f319358 protoc-28.0-linux-x86_64.zip
EOF
# Select the correct checksum for the downloaded architecture
case "$MACH" in
aarch_64) EXPECTED_SHA256="d622619dcbfb5ecb281cfb92c1a74d6a0f42e752d9a2774b197f475f7ab1c8c4" ;;
x86_64) EXPECTED_SHA256="b2e187c8b9f2d97cd3ecae4926d1bb2cbebe3ab768e7c987cbc86bb17f319358" ;;
*) echo "Unknown architecture: $MACH" >&2; exit 1 ;;
esac
# Verify checksum explicitly - fails if hash doesn't match
echo "$EXPECTED_SHA256 $FILENAME" | sha256sum -c -
unzip -d . "$FILENAME"