build: pin the WineGDK prefix directly (WINEGDK_PREFIX_SHA256)

The engine reuse path verified the released WineGDK prefix only by its
attestation and its own published sidecar, so the prefix was pinned to a
repo-committed value only transitively (via the final engine archive hash).

Commit the reproducible prefix SHA as WINEGDK_PREFIX_SHA256 and assert it in
both places: build-winegdk.yml fails closed if the packed prefix does not
reproduce it, and build-engine.yml's reuse path verifies a downloaded prefix
against it (fail fast, before packaging) in addition to the attestation. Every
reused artifact is now checked against a committed expectation directly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014pmkUWS6teoMZUUnMJG7Gr

Author: CryptoFewka

.github/workflows/build-engine.yml

@@ -96,6 +96,10 @@ jobs:
           gh attestation verify "${{ runner.temp }}/wg-dl/winegdk-prefix-${short}.tar.gz" \
             -R "${{ github.repository }}"
           (cd "${{ runner.temp }}/wg-dl" && sha256sum -c "winegdk-prefix-${short}.tar.gz.sha256")
+          # Also fail closed unless the reused prefix matches the committed pin,
+          # not just its own published sidecar.
+          pin="$(grep -m1 '^WINEGDK_PREFIX_SHA256 = ' bol/config.py | cut -d'"' -f2)"
+          echo "${pin}  ${{ runner.temp }}/wg-dl/winegdk-prefix-${short}.tar.gz" | sha256sum -c -
 
       - name: Unpack WineGDK prefix
         run: |

.github/workflows/build-winegdk.yml

@@ -90,6 +90,15 @@ jobs:
             --mtime=@1784308597 --owner=0 --group=0 --numeric-owner \
             -C /mnt/engine -cf - prefix | gzip -n -6 > "$out"
           sha="$(sha256sum "$out" | cut -d' ' -f1)"
+          # Fail closed unless the prefix reproduces the committed pin.
+          pin="$(grep -m1 '^WINEGDK_PREFIX_SHA256 = ' bol/config.py | cut -d'"' -f2)"
+          echo "pinned : $pin"
+          echo "built  : $sha"
+          if [ "$sha" != "$pin" ]; then
+            echo "::error::WineGDK prefix SHA-256 does not match WINEGDK_PREFIX_SHA256;" \
+                 "the build did not reproduce the reviewed prefix." >&2
+            exit 1
+          fi
           echo "$sha  $out" > "$out.sha256"
           {
             echo "sha256=$sha"

bol/config.py

@@ -75,5 +75,10 @@
 # SHA-256 of the reviewed, deterministic engine archive. An invalid value makes
 # the installer fail closed rather than accepting a differently packed engine.
 WINEGDK_ARCHIVE_SHA256 = "d501d9fa86a01f51cd8697cd7c8012ce9cf5eeac701b41a8feaafb694a9757b5"
+# SHA-256 of the deterministic WineGDK prefix tarball (build intermediate, not a
+# runtime download). build-winegdk.yml asserts it, and build-engine.yml verifies
+# a reused prefix against it, so the reuse path fails fast against a committed
+# expectation instead of only transitively via the engine archive hash above.
+WINEGDK_PREFIX_SHA256 = "e65d30369729260f6e8ea067e98b17c3c9460d1ed2190a0a570a11ad60836046"
 
 SELF_REPO = WINEGDK_PREBUILT_REPO

docs/BUILD.md

@@ -89,6 +89,7 @@ not to loosen the check:
   SHA in `provenance.env` and `package-engine.sh`).
 - xcurl set → `OPENSSL_XCURL_REV` + `OPENSSL_XCURL_ARCHIVE_SHA256` (regenerate
   `third_party/xcurl-msys2.lock` if msys2 rotated a package off the mirror).
+- WineGDK prefix → `WINEGDK_PREFIX_SHA256` (the reuse path and `build-winegdk.yml` both assert it).
 - engine → `WINEGDK_ARCHIVE_SHA256` and the `bol/vkd3d.py` manifest pins.
 
 ## CI environment