From 47dc3ce6ab6e1cddca6a511248a6cc63f6940084 Mon Sep 17 00:00:00 2001
From: Stenzek <stenzek@gmail.com>
Date: Fri, 13 Mar 2026 20:31:44 +1000
Subject: [PATCH] CI: Verify hashes of dependencies

---
 .github/workflows/linux-appimage-build.yml       | 1 +
 .github/workflows/linux-cross-appimage-build.yml | 1 +
 .github/workflows/macos-build.yml                | 1 +
 .github/workflows/windows-build.yml              | 4 ++++
 dep/.gitattributes                               | 2 ++
 dep/PREBUILT-SHA256SUMS                          | 6 ++++++
 6 files changed, 15 insertions(+)
 create mode 100644 dep/.gitattributes
 create mode 100644 dep/PREBUILT-SHA256SUMS

diff --git a/.github/workflows/linux-appimage-build.yml b/.github/workflows/linux-appimage-build.yml
index 178a37b27..bf016b9bf 100644
--- a/.github/workflows/linux-appimage-build.yml
+++ b/.github/workflows/linux-appimage-build.yml
@@ -36,6 +36,7 @@ jobs:
         DEPS_VERSION=$(cat dep/PREBUILT-VERSION)
         cd dep/prebuilt
         curl --retry 5 --retry-all-errors -LO "https://github.com/duckstation/dependencies/releases/download/$DEPS_VERSION/deps-linux-x64.tar.xz"
+        sha256sum --check --ignore-missing ../PREBUILT-SHA256SUMS
         tar -xf "deps-linux-x64.tar.xz"
         rm "deps-linux-x64.tar.xz"
 
diff --git a/.github/workflows/linux-cross-appimage-build.yml b/.github/workflows/linux-cross-appimage-build.yml
index 22d475910..b758f2ae8 100644
--- a/.github/workflows/linux-cross-appimage-build.yml
+++ b/.github/workflows/linux-cross-appimage-build.yml
@@ -31,6 +31,7 @@ jobs:
         cd dep/prebuilt
         curl --retry 5 --retry-all-errors -LO "https://github.com/duckstation/dependencies/releases/download/$DEPS_VERSION/deps-linux-x64.tar.xz"
         curl --retry 5 --retry-all-errors -LO "https://github.com/duckstation/dependencies/releases/download/$DEPS_VERSION/deps-linux-cross-${{matrix.arch}}.tar.xz"
+        sha256sum --check --ignore-missing ../PREBUILT-SHA256SUMS
         tar -xf "deps-linux-x64.tar.xz"
         tar -xf "deps-linux-cross-${{matrix.arch}}.tar.xz"
         rm "deps-linux-x64.tar.xz" "deps-linux-cross-${{matrix.arch}}.tar.xz"
diff --git a/.github/workflows/macos-build.yml b/.github/workflows/macos-build.yml
index 80258ba41..bebb78847 100644
--- a/.github/workflows/macos-build.yml
+++ b/.github/workflows/macos-build.yml
@@ -28,6 +28,7 @@ jobs:
         DEPS_VERSION=$(cat dep/PREBUILT-VERSION)
         cd dep/prebuilt
         curl --retry 5 --retry-all-errors -LO "https://github.com/duckstation/dependencies/releases/download/$DEPS_VERSION/deps-macos-universal.tar.xz"
+        sha256sum --check --ignore-missing ../PREBUILT-SHA256SUMS
         tar -xf "deps-macos-universal.tar.xz"
         rm "deps-macos-universal.tar.xz"
 
diff --git a/.github/workflows/windows-build.yml b/.github/workflows/windows-build.yml
index c683e28e8..5859b3d59 100644
--- a/.github/workflows/windows-build.yml
+++ b/.github/workflows/windows-build.yml
@@ -58,7 +58,9 @@ jobs:
       run: |
         set /p DEPS_VERSION=<dep\PREBUILT-VERSION
         curl --retry 5 --retry-all-errors -LO "https://github.com/duckstation/dependencies/releases/download/%DEPS_VERSION%/deps-windows-x64.7z"
+        sha256sum --check --ignore-missing dep\PREBUILT-SHA256SUMS
         "C:\Program Files\7-Zip\7z.exe" x -odep\prebuilt deps-windows-x64.7z
+        del /Q deps-windows-x64.7z
 
     - name: Download ARM64 Dependencies
       shell: cmd
@@ -66,7 +68,9 @@ jobs:
       run: |
         set /p DEPS_VERSION=<dep\PREBUILT-VERSION
         curl --retry 5 --retry-all-errors -LO "https://github.com/duckstation/dependencies/releases/download/%DEPS_VERSION%/deps-windows-arm64.7z"
+        sha256sum --check --ignore-missing dep\PREBUILT-SHA256SUMS
         "C:\Program Files\7-Zip\7z.exe" x -odep\prebuilt deps-windows-arm64.7z
+        del /Q deps-windows-arm64.7z
 
     - name: Download Patch Archives
       shell: cmd
diff --git a/dep/.gitattributes b/dep/.gitattributes
new file mode 100644
index 000000000..09087e863
--- /dev/null
+++ b/dep/.gitattributes
@@ -0,0 +1,2 @@
+PREBUILT-VERSION text eol=lf
+PREBUILT-SHA256SUMS text eol=lf
\ No newline at end of file
diff --git a/dep/PREBUILT-SHA256SUMS b/dep/PREBUILT-SHA256SUMS
new file mode 100644
index 000000000..e8a405229
--- /dev/null
+++ b/dep/PREBUILT-SHA256SUMS
@@ -0,0 +1,6 @@
+a77abf0145a8a828b646f8b2b572bf5ac2889390b55c63728bc076c13aae41c5 *deps-linux-cross-arm64.tar.xz
+d8a3e6ad8027e921d5a655cc199839538c801cab914ca5e8421efce6b11446a3 *deps-linux-cross-armhf.tar.xz
+1145bb23d42b5015b9bd12598176909022cb5b03f88dd058aed02e6f49fe23e9 *deps-linux-x64.tar.xz
+716b26712aa1a750f7595e2ae4c056dcdf9b0e51184e09bd89779362d0b22bf4 *deps-macos-universal.tar.xz
+08a8d07cdff07f9e152c7034b0c0690a20223be3da831c26db19ba24e7b337b4 *deps-windows-arm64.7z
+e064af990584ca73e6935f88d1dfe7a6ace4a77eebee61b3cbd698b9951db374 *deps-windows-x64.7z