Integrated: 8369454: Verify checksums of downloaded source bundles when creating devkit

[Mikael Vidstedt]

On Wed, 8 Oct 2025 22:45:42 GMT, Mikael Vidstedt <mikael at openjdk.org> wrote:

> Let's verify that the downloaded source bundles (tar balls) are sound by computing a checksum and verifying against the baked in one.
> 
> This change also introduces a way to provide alternative mirrors for the source bundles, e.g. by setting `GCC_BASE_URL` or `GNU_BASE_URL`.
> 
> Testing:
> 
> * Built devkit on linux-x64
> * Tested that overriding `GNU_BASE_URL` works as expected
> * Verified that the JDK builds with the new devkit

This pull request has now been integrated.

Changeset: cd1ce588
Author:    Mikael Vidstedt <mikael at openjdk.org>
URL:       https://git.openjdk.org/jdk/commit/cd1ce5883db55540379ce090244b698696e16ec3
Stats:     46 lines in 1 file changed: 31 ins; 0 del; 15 mod

8369454: Verify checksums of downloaded source bundles when creating devkit

Reviewed-by: erikj

-------------

PR: https://git.openjdk.org/jdk/pull/27708