# musl-cross 20260823 corresponding source bundle

Corresponding source of the cross-tools/musl-cross 20260823 toolchains (`x86_64-unknown-linux-musl`, `aarch64-unknown-linux-musl`) installed in the amd64 `ht-docker-node:latest` image. Prepared 2026-10-15. `SHA256SUMS` lists every file; total size 277,316,840 bytes (about 264 MiB) without this file and `SHA256SUMS`.

Mirror location: `https://code.foss.global/host.today/ht-docker-node/releases/download/v8.0.0/<asset>`, one release asset per file, plus `SHA256SUMS` and this `MANIFEST.md`.

## Build recipe

| File | Upstream | Verification |
|---|---|---|
| `musl-cross-20260823-5ac78a0bb22243c9e15247c6416b2acb67e326ee.tar.gz` | `git archive` of <https://github.com/cross-tools/musl-cross> at commit `5ac78a0bb22243c9e15247c6416b2acb67e326ee` | The tag `20260823` resolves to that commit (GitHub API `git/ref/tags/20260823`); fetched by commit ID, so Git verified the tree. Its `builder` submodule entry is `d7a90ff11aae5e59d6acd8c491f0297c15b7fa37`. No `*.patch` files exist under `targets/aarch64-unknown-linux-musl` or `targets/x86_64-unknown-linux-musl`. |
| `crosstool-ng-d7a90ff11aae5e59d6acd8c491f0297c15b7fa37.tar.gz` | `git archive` of <https://github.com/crosstool-ng/crosstool-ng> at commit `d7a90ff11aae5e59d6acd8c491f0297c15b7fa37` (the submodule pin) | Fetched by commit ID. Holds the bundled component patches (`packages/<component>/<version>/*.patch`) and the `chksum` files used below. |

## Component archives

Each archive is the format crosstool-NG fetches first for the version both configurations select (`CT_*_VERSION` in `share/<triple>-ct-ng.config.bz2` of each toolchain; the two configurations differ only in the target architecture). Every archive matches the SHA-256 in crosstool-NG's `packages/<component>/<version>/chksum` at the pinned commit. Signatures were checked with `gpg --verify` against keys fetched for this check (GNU keyring `https://ftp.gnu.org/gnu/gnu-keyring.gpg`, `https://musl.libc.org/musl.pub`, kernel.org `pgpkeys.git` key `38DBBDC86092693E`, keys.openpgp.org, keyserver.ubuntu.com); the keys carry no web-of-trust path, so the signature check confirms the publisher key named, and the crosstool-NG checksum is the pin.

| File | Upstream URL | Signature |
|---|---|---|
| `gcc-16.2.0.tar.xz` | <https://ftp.gnu.org/gnu/gcc/gcc-16.2.0/gcc-16.2.0.tar.xz> | `.sig`: good, RSA `7F74F97C103468EE5D750B583AB00996FC26A641` (Richard Guenther; GNU keyring) |
| `binutils-2.47.tar.xz` | <https://ftp.gnu.org/gnu/binutils/binutils-2.47.tar.xz> | `.sig`: good, RSA `3A24BC1E8FB409FA9F14371813FCEF89DD9E3C4F` (Nick Clifton; GNU keyring) |
| `musl-1.2.6.tar.gz` | <https://musl.libc.org/releases/musl-1.2.6.tar.gz> | `.asc`: good, key `56BCDB593020450F` (musl libc; musl.libc.org/musl.pub) |
| `linux-5.4.302.tar.xz` | <https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.4.302.tar.xz> | `linux-5.4.302.tar.sign` over the uncompressed tar: good, RSA `647F28654894E3BD457199BE38DBBDC86092693E` (Greg Kroah-Hartman; kernel.org pgpkeys) |
| `gmp-6.3.0.tar.xz` | <https://gmplib.org/download/gmp/gmp-6.3.0.tar.xz> | `.sig`: good, RSA `343C2FF0FBEE5EC2EDBEF399F3599FF828C67298` (Niels Möller; GNU keyring; key now expired) |
| `mpfr-4.2.2.tar.xz` | <https://www.mpfr.org/mpfr-4.2.2/mpfr-4.2.2.tar.xz> | `.asc`: good, EdDSA `A534BE3F83E241D918280AEB5831D11A0D4DB02A` (Vincent Lefèvre; GNU keyring) |
| `mpc-1.3.1.tar.gz` | <https://ftp.gnu.org/gnu/mpc/mpc-1.3.1.tar.gz> | `.sig`: good, DSA `AD17A21EF8AED8F1CC02DBD9F7D5C9BF765C61E3` (Andreas Enge; GNU keyring; key now expired) |
| `isl-0.27.tar.xz` | <https://libisl.sourceforge.io/isl-0.27.tar.xz> | none published; crosstool-NG checksum only |
| `zlib-1.3.1.tar.xz` | <https://github.com/madler/zlib/releases/download/v1.3.1/zlib-1.3.1.tar.xz> | `.asc`: good, DSA `5ED46A6721D365587791E2AA783FCD8E58BCAFBA` (Mark Adler; keys.openpgp.org) |
| `zstd-1.5.7.tar.gz` | <https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-1.5.7.tar.gz> | `.sig`: good, RSA `4EF4AC63455FC9F4545D9B7DEF8FE99528B52FFD` (Zstandard Release Signing Key; keyserver.ubuntu.com) |
| `mold-2.41.0.tar.gz` | <https://github.com/rui314/mold/archive/refs/tags/v2.41.0.tar.gz> (saved under this name; crosstool-NG names it `v2.41.0.tar.gz`) | none published; crosstool-NG checksum only |

The signature files are part of the bundle.