chore: copy code review improvements from upstream

bazelbuild/rules_proto#205

.github/workflows/mirror_protoc_release.yml

@@ -3,6 +3,9 @@ on:
   # Trigger manually in the UI
   workflow_dispatch:
   # Trigger daily at 06:10 UTC
+  # Note, the create-pull-request action only sends a PR if there's a code change,
+  # so a no-op execution of the mirror_protoc_releases script on most days will
+  # not create a pull request.
   schedule:
     - cron: "10 6 * * *"
 

protoc/private/mirror_protoc_release.sh

@@ -30,6 +30,10 @@ map(select(.tag_name == $version))[0]
 # Create a file that looks like a checksums.txt from a shasum command, i.e.
 # sha384-RVFu8PJJCOSXwYTqH7FyWRSgsP1AAjcEa+VViddVTgtd9wYvZjQoQ8jmlFxwfFw+ protobuf-26.0-rc3.tar.gz
 # sha384-JYSXGTSBfwUU6UzqazUTkT3lTZDzx10YdaNQYjojrT7X1Ro1fA+T4tjJw0e8UISV protobuf-26.0-rc3.zip
+#
+# Note, this follows https://en.wikipedia.org/wiki/Trust_on_first_use
+# in that we assume that a release is not tampered for 24h until we mirror it, then afterward
+# we are guaranteed that whatever we initially trusted does not change.
 CHECKSUMS=$(mktemp)
 for url in $(jq --arg version $VERSION --raw-output "$DOWNLOAD_URLS_FILTER" <$RELEASES); do
     sha=$(curl -sSL $url | shasum -b -a 384 | awk "{ print \$1 }" | xxd -r -p | base64)