From: Viktor Szakats <commit@vsz.me>
Date: Thu, 5 Feb 2026 02:42:05 +0000 (+0100)
Subject: GHA/non-native: pin DJGPP toolchain to hash
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=86d8e2b94d2576e69a45469ea70706d1d6507cbc;p=thirdparty%2Fcurl.git

GHA/non-native: pin DJGPP toolchain to hash

This package is automatically bumped, but needs manual intervention
anyway, to update gcc version number in the filename.

Follow-up to 4ad0a022e1d47119c9f0b11068f3d0b0a932e989 #20517

Closes #20523
---

diff --git a/.github/workflows/non-native.yml b/.github/workflows/non-native.yml
index 5bb9d93bec..0dbc92d03d 100644
--- a/.github/workflows/non-native.yml
+++ b/.github/workflows/non-native.yml
@@ -338,7 +338,8 @@ jobs:
       MAKEFLAGS: -j 5
       MATRIX_BUILD: '${{ matrix.build }}'
       # renovate: datasource=github-releases depName=andrewwutw/build-djgpp versioning=semver-coerced registryUrl=https://github.com
-      TOOLCHAIN_VERSION: '3.4'
+      TOOLCHAIN_VERSION: 3.4
+      TOOLCHAIN_SHA256: 8464f17017d6ab1b2bb2df4ed82357b5bf692e6e2b7fee37e315638f3d505f00
     strategy:
       matrix:
         build: [autotools, cmake]
@@ -360,7 +361,7 @@ jobs:
           cd ~
           curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 120 --retry 3 --retry-connrefused \
             --location "https://github.com/andrewwutw/build-djgpp/releases/download/v${TOOLCHAIN_VERSION}/djgpp-linux64-gcc1220.tar.bz2" --output pkg.bin
-          sha256sum pkg.bin && tar -xjf pkg.bin && rm -f pkg.bin
+          sha256sum pkg.bin | tee /dev/stderr | grep -qwF -- "${TOOLCHAIN_SHA256}" && tar -xjf pkg.bin && rm -f pkg.bin
           cd djgpp
           curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
             https://www.delorie.com/pub/djgpp/current/v2tk/wat3211b.zip --output pkg.bin