https://gitlab.synchro.net/main/sbbs/-/commit/33faf0f29ff93e1f957fb507
Modified Files:
xtrn/syncbass/getdata.js xtrn/syncdrascula/getdata.js xtrn/synclure/getdata.js xtrn/syncqueen/getdata.js
Log Message:
xtrn: pin the ScummVM game-data checksums and use the mirror fallback

The four ScummVM doors fetched <zip>.sha256 from the same host that
served the archive and compared against that. With a mirror fallback in
play the archive can arrive from either host, and a hash retrieved from whichever host answered proves nothing about the bytes it came with --
so a downloaded checksum would have made the second source exactly as
trusted as the first.

Pin the published sha256 as a constant beside each build instead, drop fetch_sha256(), and route the download through xtrn_mirror_download() so
an unreachable ScummVM -- or a truncated transfer -- retries against the mirror. Every one of these URLs already pins its version, so a constant
only changes when someone deliberately edits the URL line next to it.

Each pin is the value ScummVM publishes alongside the archive, and each
was confirmed against a hash computed from the mirrored copy, so both
sources satisfy the same constant.

All four verified installing from the official source and, with
-mirror-only, from the mirror alone.

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net