Update checksum comment.

This commit is contained in:
Alejandro Cabeza Romero 2026-05-07 13:12:45 +02:00
parent 6f535d9d50
commit 120bc32b81
No known key found for this signature in database
GPG Key ID: DA3D14AE478030FD
4 changed files with 12 additions and 4 deletions

View File

@ -19,7 +19,9 @@ fn get_artifact_url(version: &str, os: &str, arch: &str) -> String {
fn fetch_library(version: &str, os: &str, arch: &str) -> Response<Body> {
let url = get_artifact_url(version, os, arch);
// TODO: Verify checksum.
// We skip checksum verification intentionally. Hardcoded hashes would protect against a
// silently replaced release asset, but require a two-step release (build → hash → commit →
// tag) which we consider too costly for now.
ureq::get(&url).call().unwrap_or_else(|error| {
panic!(
"Failed to download a prebuilt library for {os}-{arch} v{version}: {error}. \

View File

@ -19,7 +19,9 @@ fn get_artifact_url(version: &str, os: &str, arch: &str) -> String {
fn fetch_library(version: &str, os: &str, arch: &str) -> Response<Body> {
let url = get_artifact_url(version, os, arch);
// TODO: Verify checksum.
// We skip checksum verification intentionally. Hardcoded hashes would protect against a
// silently replaced release asset, but require a two-step release (build → hash → commit →
// tag) which we consider too costly for now.
ureq::get(&url).call().unwrap_or_else(|error| {
panic!(
"Failed to download a prebuilt library for {os}-{arch} v{version}: {error}. \

View File

@ -19,7 +19,9 @@ fn get_artifact_url(version: &str, os: &str, arch: &str) -> String {
fn fetch_library(version: &str, os: &str, arch: &str) -> Response<Body> {
let url = get_artifact_url(version, os, arch);
// TODO: Verify checksum.
// We skip checksum verification intentionally. Hardcoded hashes would protect against a
// silently replaced release asset, but require a two-step release (build → hash → commit →
// tag) which we consider too costly for now.
ureq::get(&url).call().unwrap_or_else(|error| {
panic!(
"Failed to download a prebuilt library for {os}-{arch} v{version}: {error}. \

View File

@ -19,7 +19,9 @@ fn get_artifact_url(version: &str, os: &str, arch: &str) -> String {
fn fetch_library(version: &str, os: &str, arch: &str) -> Response<Body> {
let url = get_artifact_url(version, os, arch);
// TODO: Verify checksum.
// We skip checksum verification intentionally. Hardcoded hashes would protect against a
// silently replaced release asset, but require a two-step release (build → hash → commit →
// tag) which we consider too costly for now.
ureq::get(&url).call().unwrap_or_else(|error| {
panic!(
"Failed to download a prebuilt library for {os}-{arch} v{version}: {error}. \