Zig Community Mirrors
10 months ago
- #CI
- #Zig
- #Community Mirrors
- Community mirrors are recommended for downloading Zig in CI to avoid sporadic failures or slow runs from ziglang.org.
- Ziglang.org is hosted on a simple one-computer setup, making community mirrors a more reliable alternative.
- Community mirrors are not officially endorsed by the Zig Software Foundation but are secure due to signed archives.
- Security notice: Always validate minisign signatures against the ZSF’s public key when using community mirrors.
- GitHub Actions users can use the mlugg/setup-zig Action for installing Zig from community mirrors and caching.
- The list of community mirrors is available at https://ziglang.org/download/community-mirrors.txt.
- Tooling should fetch and shuffle the mirror list to avoid overloading any single mirror.
- Every Zig tarball has a minisign signature; both must be downloaded and verified for security.
- Recommended workflow includes caching the mirror list and refetching it approximately once per day.
- Mirrors must support HTTPS, and requests should include a 'source' query parameter for tracking.
- If a mirror fails, try another; ziglang.org can be a fallback if all mirrors fail.
- Hosting a mirror requires consulting documentation in the www.ziglang.org repository.