Getting libxml download with the correct hash

[Cazadorro]

Our company blocks the libxml2 download through the gitlab site. I've tried seeing if we can unblock that, and I'm not getting anywhere. I've previously used the same file hosted elsewhere, and just manually put it into downloads. With the new version requirement, I can't do that. I tried repackaging it manually through tar.gz and I can't get the same hash (I don't know if I'm doing it right, and I'm on windows, so I'm afraid the file endings are converted upon cloning anyway) I can download the official distribution tarball though (but uncompressing, then attempting to recompress does not give the same hash). I'm trying this for 2.11.9. How do I get the correct download under these circumstances?

[dg0yt]

Repackaging locally won't give the same SHA512.

You get the correct download by downloading it on an unrestricted computer. Use vcpkg install --only-downloads libxml2, and transfer the relevant tarballs from the downloads directory.

[Cazadorro]

I cannot do this, this is not allowed at my company, there's zero way to transfer from a computer with out this issue (with out breaking rules) to a computer that does. In general removable media is not allowed with out special permission, and is not supposed to be used on unsecure systems. I could however use the download for the tar.gz on github provided here #11799, but again that's not the correct version.

[dg0yt]

I didn't suggest to break the rules. The transfer is left to what is available to you.

(Downloads of release tarballs don't solve actual security concerns, cf. the lzma incident. Other companies might block those downloads instead of the GNOME git servers. So switching the source could just move the problem to other users.)