From 40f5fbd3cfa9e667502a722cd8314f8bf1938db8 Mon Sep 17 00:00:00 2001
From: Ali <alliasgher123@gmail.com>
Date: Fri, 24 Apr 2026 00:07:12 +0500
Subject: [PATCH] ci: switch build scripts from wget to curl

runc's build scripts and CI setup used a mix of wget (4 sites) and
curl (8 sites) for HTTPS fetches. Standardise the three script sites on
curl, which is already required by the majority of call sites.

* script/build-libpathrs.sh and script/build-seccomp.sh: replace
  wget "<url>"{,.asc} with curl -fsSLO "<url>"{,.asc}. Bash brace
  expansion still yields two separate downloads (the tarball and its
  .asc signature).
* script/setup_host.sh: replace wget with curl in the Fedora RPM
  install list.

Leaving the single wget call in Dockerfile untouched per review
feedback -- the trixie base image already ships wget, and switching
would add an extra apt-get update && install step before the existing
single-pass package install.

Refs #5240

Signed-off-by: Ali <alliasgher123@gmail.com>
---
 script/build-libpathrs.sh | 2 +-
 script/build-seccomp.sh   | 2 +-
 script/setup_host.sh      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/script/build-libpathrs.sh b/script/build-libpathrs.sh
index 721e611f7..94712db40 100755
--- a/script/build-libpathrs.sh
+++ b/script/build-libpathrs.sh
@@ -75,7 +75,7 @@ function build_libpathrs() {
 	local tar="libpathrs-${ver}.tar.xz"
 
 	# Download, check, and extract.
-	wget "https://github.com/cyphar/libpathrs/releases/download/v${ver}/${tar}"{,.asc}
+	curl -fsSL --remote-name-all "https://github.com/cyphar/libpathrs/releases/download/v${ver}/${tar}"{,.asc}
 	sha256sum --strict --check - <<<"${LIBPATHRS_SHA256[${ver}]} *${tar}"
 
 	local srcdir
diff --git a/script/build-seccomp.sh b/script/build-seccomp.sh
index 1c1b9671e..7dc6b1ff9 100755
--- a/script/build-seccomp.sh
+++ b/script/build-seccomp.sh
@@ -27,7 +27,7 @@ function build_libseccomp() {
 	local tar="libseccomp-${ver}.tar.gz"
 
 	# Download, check, and extract.
-	wget "https://github.com/seccomp/libseccomp/releases/download/v${ver}/${tar}"{,.asc}
+	curl -fsSL --remote-name-all "https://github.com/seccomp/libseccomp/releases/download/v${ver}/${tar}"{,.asc}
 	sha256sum --strict --check - <<<"${SECCOMP_SHA256[${ver}]} *${tar}"
 
 	local srcdir
diff --git a/script/setup_host.sh b/script/setup_host.sh
index e42426263..639771f69 100755
--- a/script/setup_host.sh
+++ b/script/setup_host.sh
@@ -34,7 +34,7 @@ platform:el9 | platform:el10)
 esac
 
 # Install common packages
-RPMS=(cargo container-selinux fuse-sshfs git-core glibc-static golang iptables jq libseccomp-devel lld make policycoreutils wget)
+RPMS=(cargo container-selinux curl fuse-sshfs git-core glibc-static golang iptables jq libseccomp-devel lld make policycoreutils)
 # Work around dnf mirror failures by retrying a few times.
 for i in $(seq 0 2); do
 	sleep "$i"