chore: apply AI code review suggestions

- homebrew: use 'curl -fLsS' for checksum downloads so a missing core asset
  hard-fails the job under always() instead of baking a corrupt sha256 into
  the formula (coderabbit)
- musl zig setup: verify the Zig tarball with minisign against the official
  ziglang.org public key before extracting/executing it (coderabbit)

Author: amondnet

.github/workflows/release-please.yml

@@ -185,14 +185,17 @@ jobs:
           VERSION=${{ needs.release-please.outputs.tag_name }}
           VERSION_NO_V=${VERSION#v}
 
-          # Download checksums
-          curl -L -o darwin-x64.sha256 \
+          # Download checksums. -f makes curl fail (non-zero) on a 404 instead of
+          # writing an HTML error page into the .sha256 file — so when a core
+          # target is missing under always(), this job hard-fails rather than
+          # baking a corrupt checksum into the formula.
+          curl -fLsS -o darwin-x64.sha256 \
             "https://github.com/${{ github.repository }}/releases/download/${VERSION}/csp-darwin-x64.sha256"
-          curl -L -o darwin-arm64.sha256 \
+          curl -fLsS -o darwin-arm64.sha256 \
             "https://github.com/${{ github.repository }}/releases/download/${VERSION}/csp-darwin-arm64.sha256"
-          curl -L -o linux-x64.sha256 \
+          curl -fLsS -o linux-x64.sha256 \
             "https://github.com/${{ github.repository }}/releases/download/${VERSION}/csp-linux-x64.sha256"
-          curl -L -o linux-arm64.sha256 \
+          curl -fLsS -o linux-arm64.sha256 \
             "https://github.com/${{ github.repository }}/releases/download/${VERSION}/csp-linux-arm64.sha256"
 
           # Extract checksums

.github/workflows/release-rust.yml

@@ -83,8 +83,16 @@ jobs:
         if: ${{ endsWith(matrix.target, '-musl') }}
         run: |
           ZIG_VERSION=0.13.0
-          curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-x86_64-${ZIG_VERSION}.tar.xz" \
-            | tar -xJ -C "$RUNNER_TEMP"
+          # Zig signs releases with minisign (not SHA checksums). Verify the
+          # tarball against the official ziglang.org public key before extracting
+          # and executing it, so a compromised mirror/MITM can't inject a binary.
+          ZIG_PUBKEY="RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U"
+          TARBALL="zig-linux-x86_64-${ZIG_VERSION}.tar.xz"
+          sudo apt-get update && sudo apt-get install -y minisign
+          curl -fsSLO "https://ziglang.org/download/${ZIG_VERSION}/${TARBALL}"
+          curl -fsSLO "https://ziglang.org/download/${ZIG_VERSION}/${TARBALL}.minisig"
+          minisign -Vm "${TARBALL}" -P "${ZIG_PUBKEY}"
+          tar -xJf "${TARBALL}" -C "$RUNNER_TEMP"
           echo "$RUNNER_TEMP/zig-linux-x86_64-${ZIG_VERSION}" >> "$GITHUB_PATH"
           cargo install --locked cargo-zigbuild --version '^0.19'