Follow-up from the CI-download-integrity discussion (2026-07-08). Goal: every external download in CI is either pinned to a published checksum or verified against one, failing closed on corruption/tampering.
Gradle distribution — distributionSha256Sum pin (PR from this discussion).
Remaining scope:
system-images — revision-pin the system-images;android-<api>;google_apis;x86_64 ids so sdkmanager verifies a deterministic artifact (today it resolves to latest; the emulator package is a moving target, hard to pin explicitly, so revision-pinning + sdkmanager's own SHA-1 check is the pragmatic path).
Cache integrity — the corruption that deadlocked the queue 2026-07-08 was in the restored Actions cache (extracted tree, bypasses sdkmanager's download-time SHA check), not the download. Decide between (a) verifying cache contents on restore, or (b) de-caching the fragile emulator/system-image packages (#446 already de-caches the emulator). This is arguably higher-leverage than re-pinning already-verified downloads.
Audit ci.yml for any other raw curl/wget/urlretrieve fetches and pin them.
Priority P3 (hardening; the acute corrupt-zip + boot-race issues are handled by #443/#446/#448).
Follow-up from the CI-download-integrity discussion (2026-07-08). Goal: every external download in CI is either pinned to a published checksum or verified against one, failing closed on corruption/tampering.
**Done:**
- cmdline-tools — SHA-256 + size pin, verify->reject->retry (#389).
- Gradle distribution — `distributionSha256Sum` pin (PR from this discussion).
**Remaining scope:**
1. **system-images** — revision-pin the `system-images;android-<api>;google_apis;x86_64` ids so sdkmanager verifies a deterministic artifact (today it resolves to *latest*; the emulator package is a moving target, hard to pin explicitly, so revision-pinning + sdkmanager's own SHA-1 check is the pragmatic path).
2. **Cache integrity** — the corruption that deadlocked the queue 2026-07-08 was in the restored **Actions cache** (extracted tree, bypasses sdkmanager's download-time SHA check), not the download. Decide between (a) verifying cache contents on restore, or (b) de-caching the fragile emulator/system-image packages (#446 already de-caches the emulator). This is arguably higher-leverage than re-pinning already-verified downloads.
3. Audit `ci.yml` for any other raw `curl`/`wget`/`urlretrieve` fetches and pin them.
Priority P3 (hardening; the acute corrupt-zip + boot-race issues are handled by #443/#446/#448).
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up from the CI-download-integrity discussion (2026-07-08). Goal: every external download in CI is either pinned to a published checksum or verified against one, failing closed on corruption/tampering.
Done:
distributionSha256Sumpin (PR from this discussion).Remaining scope:
system-images;android-<api>;google_apis;x86_64ids so sdkmanager verifies a deterministic artifact (today it resolves to latest; the emulator package is a moving target, hard to pin explicitly, so revision-pinning + sdkmanager's own SHA-1 check is the pragmatic path).ci.ymlfor any other rawcurl/wget/urlretrievefetches and pin them.Priority P3 (hardening; the acute corrupt-zip + boot-race issues are handled by #443/#446/#448).