https://gitlab.synchro.net/main/sbbs/-/commit/645fb6e2dd1cbc76056ef17d
Modified Files:
xtrn/syncdoom/getwads.js xtrn/syncduke/download.js
Log Message:
xtrn: verify the Freedoom and Duke shareware downloads

Neither fetcher checked what it downloaded. That was tolerable while
each had exactly one source; with a mirror fallback in play an
unverified fetcher accepts whatever either host hands it, so adding the
second source would have weakened them rather than strengthened them.

Pin sha256 for both Freedoom release zips and for the Duke shareware
package, and route both downloads through xtrn_mirror_download(), which
treats a checksum mismatch the same as an unreachable host and retries
against the mirror.

The Freedoom constants are the sums published with the release. The Duke
one is not published by anyone -- dnr.duke4.net offers no checksum -- so
it was minted from what that host serves. It attests that the mirror
matches the official source as vetted, which is the property a mirror
needs, rather than an upstream attestation.

Both files also gain the *_NO_MAIN guard the sibling fetchers use, so
their pinned tables can be read by another script without running an
install as a side effect of load().

Both verified installing from the official source and, with
-mirror-only, from the mirror alone.

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net