From 00d32e2f113d19398dbae3cc36321912cb51780f Mon Sep 17 00:00:00 2001
From: oech3 <79379754+oech3@users.noreply.github.com>
Date: Tue, 6 Oct 2026 06:48:38 +0900
Subject: [PATCH] build-gnu.sh: harden downloading process of tarball

---
 util/build-gnu.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/util/build-gnu.sh b/util/build-gnu.sh
index 4cca2bf..a760a68 100755
--- a/util/build-gnu.sh
+++ b/util/build-gnu.sh
@@ -29,7 +29,10 @@ if test ! -d "${path_GNU}/README"; then
     echo "Extracting GNU tar..."
     mkdir -p "${path_GNU}"
     cd "${path_GNU}"
-    curl -L https://ftpmirror.gnu.org/tar/tar-1.35.tar.xz | tar xJf - --strip-components=1
+    curl -fsSL https://ftpmirror.gnu.org/tar/tar-1.35.tar.xz -o gnu-tar.tar.xz
+    echo e1a200d21f433cd7d917dd979db16919a9167056ae62cf7d038a6118e56b2fe419cd4a396eee66f1f4dc13a8dc380e23f6ffd7ee0ca84e5dd9ad9411f60e002c  gnu-tar.tar.xz \
+     | b2sum --check
+    tar xJf gnu-tar.tar.xz --strip-components=1
 fi
 
 cd "${path_GNU}"