RFR: 8369454: Verify checksums of downloaded source bundles when creating devkit [v2]

[Mikael Vidstedt]

On Thu, 9 Oct 2025 18:09:23 GMT, Mikael Vidstedt <mikael at openjdk.org> wrote:

>> Let's verify that the downloaded source bundles (tar balls) are sound by computing a checksum and verifying against the baked in one.
>> 
>> This change also introduces a way to provide alternative mirrors for the source bundles, e.g. by setting `GCC_BASE_URL` or `GNU_BASE_URL`.
>> 
>> Testing:
>> 
>> * Built devkit on linux-x64
>> * Tested that overriding `GNU_BASE_URL` works as expected
>> * Verified that the JDK builds with the new devkit
>
> Mikael Vidstedt has updated the pull request incrementally with three additional commits since the last revision:
> 
>  - Update DownloadVerify comment
>  - Rename DownloadVerify
>  - Update make/devkit/Tools.gmk
>    
>    Co-authored-by: Erik Joelsson <37597443+erikj79 at users.noreply.github.com>

Thank you for the review!

-------------

PR Comment: https://git.openjdk.org/jdk/pull/27708#issuecomment-3387298736