All three archives now carry a SHA256 in versions.env, taken from a double fetch that agreed with itself and enforced the way JDK_SHA256 is: a cached file that fails is refetched, a fresh one that fails fails the build. The source tarball's digest rests on GitHub keeping tag-archive generation stable; if that moves, the build names the line to refresh.