Downloads: check hashes and upload as artifact (#5)

.github/workflows/build.yml

@@ -25,6 +25,18 @@ jobs:
           name: binary_package
           path: upload/*
 
+      - name: Upload DOWNLOADS.txt
+        uses: actions/[email protected]
+        with:
+          name: downloads-info-Ubuntu
+          path: DOWNLOADS.txt
+
+      - name: Upload downloads
+        uses: actions/[email protected]
+        with:
+          name: downloads-Ubuntu
+          path: downloads
+
       - name: Generate artifact hashes
         shell: bash
         id: hash
@@ -69,6 +81,18 @@ jobs:
         with:
           name: binary_package
           path: upload/*
+
+      - name: Upload DOWNLOADS.txt
+        uses: actions/[email protected]
+        with:
+          name: downloads-info-MacOS
+          path: DOWNLOADS.txt
+
+      - name: Upload downloads
+        uses: actions/[email protected]
+        with:
+          name: downloads-MacOS
+          path: downloads
 
       - name: Generate artifact hashes
         shell: bash

Makefile

@@ -8,7 +8,7 @@ OCAML_VERSION=4.14.0
 OCAML_BINARY=$(PREFIX)/bin/ocamlopt.opt
 
 ocaml-$(OCAML_VERSION).tar.gz:
-	curl -L https://github.com/ocaml/ocaml/archive/$(OCAML_VERSION).tar.gz > ocaml-$(OCAML_VERSION).tar.gz
+	./download ocaml-$(OCAML_VERSION).tar.gz https://github.com/ocaml/ocaml/archive/$(OCAML_VERSION).tar.gz 39f44260382f28d1054c5f9d8bf4753cb7ad64027da792f7938344544da155e8
 
 ocaml-$(OCAML_VERSION): ocaml-$(OCAML_VERSION).tar.gz
 	tar xzf ocaml-$(OCAML_VERSION).tar.gz
@@ -31,7 +31,7 @@ FINDLIB_VERSION=1.9.5
 FINDLIB_BINARY=$(PREFIX)/bin/ocamlfind
 
 findlib-$(FINDLIB_VERSION).tar.gz:
-	curl -L http://download.camlcity.org/download/findlib-$(FINDLIB_VERSION).tar.gz > findlib-$(FINDLIB_VERSION).tar.gz
+	./download findlib-$(FINDLIB_VERSION).tar.gz http://download.camlcity.org/download/findlib-$(FINDLIB_VERSION).tar.gz 0d4704e60caf313c1bb4565d8690d503ce51fb93c2ea50e22b2e9812243a2571
 
 findlib-$(FINDLIB_VERSION): findlib-$(FINDLIB_VERSION).tar.gz
 	tar xzf findlib-$(FINDLIB_VERSION).tar.gz
@@ -62,7 +62,7 @@ NUM_VERSION=1.4
 NUM_BINARY=$(PREFIX)/lib/ocaml/nums.cmxa
 
 num-$(NUM_VERSION).tar.gz:
-	curl -Lfo num-$(NUM_VERSION).tar.gz https://github.com/ocaml/num/archive/v$(NUM_VERSION).tar.gz
+	./download num-$(NUM_VERSION).tar.gz https://github.com/ocaml/num/archive/v$(NUM_VERSION).tar.gz 015088b68e717b04c07997920e33c53219711dfaf36d1196d02313f48ea00f24
 
 num-$(NUM_VERSION): num-$(NUM_VERSION).tar.gz
 	tar xzf num-$(NUM_VERSION).tar.gz
@@ -82,7 +82,7 @@ OCAMLBUILD_VERSION=0.14.2
 OCAMLBUILD_BINARY=$(PREFIX)/bin/ocamlbuild
 
 ocamlbuild-$(OCAMLBUILD_VERSION).tar.gz:
-	curl -Lfo ocamlbuild-$(OCAMLBUILD_VERSION).tar.gz https://github.com/ocaml/ocamlbuild/archive/$(OCAMLBUILD_VERSION).tar.gz
+	./download ocamlbuild-$(OCAMLBUILD_VERSION).tar.gz https://github.com/ocaml/ocamlbuild/archive/$(OCAMLBUILD_VERSION).tar.gz 62d2dab6037794c702a83ac584a7066d018cf1645370d1f3d5764c2b458791b1
 
 ocamlbuild-$(OCAMLBUILD_VERSION): ocamlbuild-$(OCAMLBUILD_VERSION).tar.gz
 	tar xzf ocamlbuild-$(OCAMLBUILD_VERSION).tar.gz
@@ -102,7 +102,7 @@ DUNE_VERSION=3.7.1
 DUNE_BINARY=$(PREFIX)/bin/dune
 
 dune-$(DUNE_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/ocaml/dune/archive/refs/tags/$(DUNE_VERSION).tar.gz
+	./download $@ https://github.com/ocaml/dune/archive/refs/tags/$(DUNE_VERSION).tar.gz 9ddc1dae09e7be6d0bf22b7d1584d95a1b3d4f5d1bae1d4095dc4e1833fa86b2
 
 dune-$(DUNE_VERSION): dune-$(DUNE_VERSION).tar.gz
 	tar xzf $<
@@ -123,7 +123,7 @@ CAMLP_STREAMS_VERSION=5.0.1
 CAMLP_STREAMS_BINARY=$(PREFIX)/lib/ocaml/camlp-stream/camlp-streams.cmxa
 
 camlp-streams-$(CAMLP_STREAMS_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/ocaml/camlp-streams/archive/refs/tags/v$(CAMLP_STREAMS_VERSION).tar.gz
+	./download $@ https://github.com/ocaml/camlp-streams/archive/refs/tags/v$(CAMLP_STREAMS_VERSION).tar.gz ad71f62406e9bb4e7fb5d4593ede2af6c68f8b0d96f25574446e142c3eb0d9a4
 
 camlp-streams-$(CAMLP_STREAMS_VERSION): camlp-streams-$(CAMLP_STREAMS_VERSION).tar.gz
 	tar xzf $<
@@ -144,7 +144,7 @@ CAMLP4_DIR:=camlp4-$(subst +,-,$(CAMLP4_VERSION))
 CAMLP4_BINARY:=$(PREFIX)/bin/camlp4o
 
 $(CAMLP4_DIR).tar.gz:
-	curl -Lfo $(CAMLP4_DIR).tar.gz https://github.com/ocaml/camlp4/archive/$(CAMLP4_VERSION).tar.gz
+	./download $(CAMLP4_DIR).tar.gz https://github.com/ocaml/camlp4/archive/$(CAMLP4_VERSION).tar.gz 553b6805dffc05eb4749b0293df47a18b82b9d9dcc125d688e55f13cbec0b93a
 
 $(CAMLP4_DIR): $(CAMLP4_DIR).tar.gz
 	tar xzf $(CAMLP4_DIR).tar.gz
@@ -165,7 +165,7 @@ LABLGTK_VERSION=2.18.13
 LABLGTK_BINARY=$(PREFIX)/lib/ocaml/lablgtk2/lablgtk.cmxa
 
 lablgtk-$(LABLGTK_VERSION).tar.gz:
-	curl -Lfo lablgtk-$(LABLGTK_VERSION).tar.gz https://github.com/garrigue/lablgtk/archive/refs/tags/$(LABLGTK_VERSION).tar.gz
+	./download lablgtk-$(LABLGTK_VERSION).tar.gz https://github.com/garrigue/lablgtk/archive/refs/tags/$(LABLGTK_VERSION).tar.gz 7b9e680452458fd351cf8622230d62c3078db528446384268cd0dc37be82143c
 
 lablgtk-$(LABLGTK_VERSION): lablgtk-$(LABLGTK_VERSION).tar.gz
 	tar xzf lablgtk-$(LABLGTK_VERSION).tar.gz
@@ -187,7 +187,7 @@ Z3_BINARY=$(PREFIX)/bin/z3
 Z3_DIR=z3-Z3-$(Z3_VERSION)
 
 z3-$(Z3_VERSION).tar.gz:
-	curl -Lfo z3-$(Z3_VERSION).tar.gz https://github.com/Z3Prover/z3/archive/Z3-$(Z3_VERSION).tar.gz
+	./download z3-$(Z3_VERSION).tar.gz https://github.com/Z3Prover/z3/archive/Z3-$(Z3_VERSION).tar.gz 4e8e232887ddfa643adb6a30dcd3743cb2fa6591735fbd302b49f7028cdc0363
 
 $(Z3_DIR): z3-$(Z3_VERSION).tar.gz
 	tar xzf z3-$(Z3_VERSION).tar.gz
@@ -208,7 +208,7 @@ CSEXP_VERSION=1.5.1
 CSEXP_BINARY=$(PREFIX)/lib/ocaml/csexp/csexp.cmxa
 
 csexp-$(CSEXP_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/ocaml-dune/csexp/archive/refs/tags/$(CSEXP_VERSION).tar.gz
+	./download $@ https://github.com/ocaml-dune/csexp/archive/refs/tags/$(CSEXP_VERSION).tar.gz ffab41b0b0f65ade305043205229a7649591195cbe86e24f2c254e9dc5b14a34
 
 csexp-$(CSEXP_VERSION): csexp-$(CSEXP_VERSION).tar.gz
 	tar xzf $<
@@ -233,7 +233,7 @@ SEXPLIB0_VERSION=0.15.1
 SEXPLIB0_BINARY=$(PREFIX)/lib/ocaml/sexplib0/sexplib0.cmxa
 
 sexplib0-$(SEXPLIB0_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/janestreet/sexplib0/archive/refs/tags/v$(SEXPLIB0_VERSION).tar.gz
+	./download $@ https://github.com/janestreet/sexplib0/archive/refs/tags/v$(SEXPLIB0_VERSION).tar.gz e8cd817eb3bc3f84a2065fa0255ab2b986a24baf1cc329d05627c516464267b3
 
 sexplib0-$(SEXPLIB0_VERSION): sexplib0-$(SEXPLIB0_VERSION).tar.gz
 	tar xzf $<
@@ -252,7 +252,7 @@ BASE_VERSION=0.15.1
 BASE_BINARY=$(PREFIX)/lib/ocaml/base/base.cmxa
 
 base-$(BASE_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/janestreet/base/archive/refs/tags/v$(BASE_VERSION).tar.gz
+	./download $@ https://github.com/janestreet/base/archive/refs/tags/v$(BASE_VERSION).tar.gz 755e303171ea267e3ba5af7aa8ea27537f3394d97c77d340b10f806d6ef61a14
 
 base-$(BASE_VERSION): base-$(BASE_VERSION).tar.gz
 	tar xzf $<
@@ -271,7 +271,7 @@ RES_VERSION=5.0.1
 RES_BINARY=$(PREFIX)/lib/ocaml/res/res.cmxa
 
 res-$(RES_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/mmottl/res/archive/refs/tags/$(RES_VERSION).tar.gz
+	./download $@ https://github.com/mmottl/res/archive/refs/tags/$(RES_VERSION).tar.gz df7965f5021a4422a462545647aad420a50dd8ba69c504eff74b3c346593b70d
 
 res-$(RES_VERSION): res-$(RES_VERSION).tar.gz
 	tar xzf $<
@@ -290,7 +290,7 @@ STDIO_VERSION=0.15.0
 STDIO_BINARY=$(PREFIX)/lib/ocaml/stdio/stdio.cmxa
 
 stdio-$(STDIO_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/janestreet/stdio/archive/refs/tags/v$(STDIO_VERSION).tar.gz
+	./download $@ https://github.com/janestreet/stdio/archive/refs/tags/v$(STDIO_VERSION).tar.gz 49f2478fc08677a54bffaeb2b017d23ece19ab5c1d6c993513a20b34aeee81a7
 
 stdio-$(STDIO_VERSION): stdio-$(STDIO_VERSION).tar.gz
 	tar xzf $<
@@ -309,7 +309,7 @@ CPPO_VERSION=1.6.9
 CPPO_BINARY=$(PREFIX)/bin/cppo
 
 cppo-$(CPPO_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/ocaml-community/cppo/archive/refs/tags/v$(CPPO_VERSION).tar.gz
+	./download $@ https://github.com/ocaml-community/cppo/archive/refs/tags/v$(CPPO_VERSION).tar.gz 16036d85c11d330a7c8b56f4e071d6bbe86d8937c89d3d79f6eef0e38bdda26a
 
 cppo-$(CPPO_VERSION): cppo-$(CPPO_VERSION).tar.gz
 	tar xzf $<
@@ -328,7 +328,7 @@ OCPLIB-ENDIAN_VERSION=1.2
 OCPLIB-ENDIAN_BINARY=$(PREFIX)/lib/ocaml/ocplib-endian/ocplib_endian.cmxa
 
 ocplib-endian-$(OCPLIB-ENDIAN_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/OCamlPro/ocplib-endian/archive/$(OCPLIB-ENDIAN_VERSION).tar.gz
+	./download $@ https://github.com/OCamlPro/ocplib-endian/archive/$(OCPLIB-ENDIAN_VERSION).tar.gz 97ae74e8aeead46a0475df14af637ce78e2372c07258619ad8967506f2d4b320
 
 ocplib-endian-$(OCPLIB-ENDIAN_VERSION): ocplib-endian-$(OCPLIB-ENDIAN_VERSION).tar.gz
 	tar xzf $<
@@ -348,7 +348,7 @@ STDINT_DIR=ocaml-stdint-$(STDINT_VERSION)
 STDINT_BINARY=$(PREFIX)/lib/ocaml/stdint/stdint.cmxa
 
 stdint-$(STDINT_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/andrenth/ocaml-stdint/archive/refs/tags/$(STDINT_VERSION).tar.gz
+	./download $@ https://github.com/andrenth/ocaml-stdint/archive/refs/tags/$(STDINT_VERSION).tar.gz b0efc17f83f4a744f0a578edce476eba83aa1894c7e45993db375189b47c5e64
 
 $(STDINT_DIR): stdint-$(STDINT_VERSION).tar.gz
 	tar xzf $<
@@ -367,7 +367,7 @@ RESULT_VERSION=1.5
 RESULT_BINARY=$(PREFIX)/lib/ocaml/result/result.cmxa
 
 result-$(RESULT_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/janestreet/result/archive/refs/tags/$(RESULT_VERSION).tar.gz
+	./download $@ https://github.com/janestreet/result/archive/refs/tags/$(RESULT_VERSION).tar.gz 1072a8b0b35bd6df939c0670add33027f981e4f69a53233cb006b442fa12af30
 
 result-$(RESULT_VERSION): result-$(RESULT_VERSION).tar.gz
 	tar xzf $<
@@ -388,7 +388,7 @@ CAPNP_DIR=capnproto-c++-$(CAPNP_VERSION)
 CAPNP_BINARY=$(PREFIX)/bin/capnp
 
 capnp-$(CAPNP_VERSION).tar.gz:
-	curl -Lfo $@ https://capnproto.org/capnproto-c++-$(CAPNP_VERSION).tar.gz
+	./download $@ https://capnproto.org/capnproto-c++-$(CAPNP_VERSION).tar.gz 981e7ef6dbe3ac745907e55a78870fbb491c5d23abd4ebc04e20ec235af4458c
 
 $(CAPNP_DIR): capnp-$(CAPNP_VERSION).tar.gz
 	tar xzf $<
@@ -410,7 +410,7 @@ CAPNP_OCAML_DIR=capnp-ocaml-$(CAPNP_OCAML_VERSION)
 CAPNP_OCAML_BINARY=$(PREFIX)/lib/ocaml/capnp/capnp.cmxa
 
 capnp-ocaml-$(CAPNP_OCAML_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/capnproto/capnp-ocaml/archive/refs/tags/v$(CAPNP_OCAML_VERSION).tar.gz
+	./download $@ https://github.com/capnproto/capnp-ocaml/archive/refs/tags/v$(CAPNP_OCAML_VERSION).tar.gz 298332601b98e271d704799520ae066f0a00c8663014b8bcb94f739eb0fb2e9f
 
 $(CAPNP_OCAML_DIR): capnp-ocaml-$(CAPNP_OCAML_VERSION).tar.gz
 	tar xzf $<
@@ -429,7 +429,7 @@ OCAML_COMPILER_LIBS_VERSION=0.12.4
 OCAML_COMPILER_LIBS_BINARY=$(PREFIX)/lib/ocaml/ocaml-compiler-libs/toplevel/ocaml_toplevel.cmxa
 
 ocaml-compiler-libs-$(OCAML_COMPILER_LIBS_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/janestreet/ocaml-compiler-libs/archive/refs/tags/v$(OCAML_COMPILER_LIBS_VERSION).tar.gz
+	./download $@ https://github.com/janestreet/ocaml-compiler-libs/archive/refs/tags/v$(OCAML_COMPILER_LIBS_VERSION).tar.gz f4c37daf975b67c1f645a5d0294ec8ca686b982da410d9f915ccd93548c6e2f1
 
 ocaml-compiler-libs-$(OCAML_COMPILER_LIBS_VERSION): ocaml-compiler-libs-$(OCAML_COMPILER_LIBS_VERSION).tar.gz
 	tar xzf $<
@@ -448,7 +448,7 @@ STDLIB-SHIMS_VERSION=0.3.0
 STDLIB-SHIMS_BINARY=$(PREFIX)/lib/ocaml/stdlib-shims/stdlib_shims.cmxa
 
 stdlib-shims-$(STDLIB-SHIMS_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/ocaml/stdlib-shims/archive/refs/tags/$(STDLIB-SHIMS_VERSION).tar.gz
+	./download $@ https://github.com/ocaml/stdlib-shims/archive/refs/tags/$(STDLIB-SHIMS_VERSION).tar.gz 6d0386313a021146300011549180fcd4e94f7ac3c3bf021ff165f6558608f0c2
 
 stdlib-shims-$(STDLIB-SHIMS_VERSION): stdlib-shims-$(STDLIB-SHIMS_VERSION).tar.gz
 	tar xzf $<
@@ -467,7 +467,7 @@ PPX_DERIVERS_VERSION=1.2.1
 PPX_DERIVERS_BINARY=$(PREFIX)/lib/ocaml/ppx_derivers/ppx_derivers.cmxa
 
 ppx_derivers-$(PPX_DERIVERS_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/ocaml-ppx/ppx_derivers/archive/refs/tags/$(PPX_DERIVERS_VERSION).tar.gz
+	./download $@ https://github.com/ocaml-ppx/ppx_derivers/archive/refs/tags/$(PPX_DERIVERS_VERSION).tar.gz b6595ee187dea792b31fc54a0e1524ab1e48bc6068d3066c45215a138cc73b95
 
 ppx_derivers-$(PPX_DERIVERS_VERSION): ppx_derivers-$(PPX_DERIVERS_VERSION).tar.gz
 	tar xzf $<
@@ -486,7 +486,7 @@ PPXLIB_VERSION=0.28.0
 PPXLIB_BINARY=$(PREFIX)/lib/ocaml/ppxlib/ppxlib.cmxa
 
 ppxlib-$(PPXLIB_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/ocaml-ppx/ppxlib/archive/refs/tags/$(PPXLIB_VERSION).tar.gz
+	./download $@ https://github.com/ocaml-ppx/ppxlib/archive/refs/tags/$(PPXLIB_VERSION).tar.gz 9340fd70bb0743ab7984df35a6aea16e3fe1a6a8b0d4e885ad7afba9befb2e43
 
 ppxlib-$(PPXLIB_VERSION): ppxlib-$(PPXLIB_VERSION).tar.gz
 	tar xzf $<
@@ -505,7 +505,7 @@ PPX_PARSER_VERSION=0.1.0
 PPX_PARSER_BINARY=$(PREFIX)/lib/ocaml/ppx_parser/ppx_parser.cmxa
 
 ppx_parser-$(PPX_PARSER_VERSION).tar.gz:
-	curl -Lfo $@ https://github.com/NielsMommen/ppx_parser/archive/refs/tags/$(PPX_PARSER_VERSION).tar.gz
+	./download $@ https://github.com/NielsMommen/ppx_parser/archive/refs/tags/$(PPX_PARSER_VERSION).tar.gz 42007eb6dfd7c6cdc02a4acae8a4d48626ba06fca4d5590aeeb1420943d0dc79
 
 ppx_parser-$(PPX_PARSER_VERSION): ppx_parser-$(PPX_PARSER_VERSION).tar.gz
 	tar xzf $<

download

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -e
+
+curl -Lfo $1 $2
+SHASUM="$(shasum -a 256 $1)"
+HASH="${SHASUM%% *}"
+echo "$SHASUM $2" >> DOWNLOADS.txt
+if [[ "$HASH" != "$3" ]]
+then
+  echo "Actual SHA-256 hash $HASH of $1 does not match expected hash $3"
+  exit 1
+fi
+mkdir -p downloads
+cp $1 downloads/$1