manually download zig

.tangled/workflows/build.yml

···
 engine: nixery
 
 dependencies:
-    # nixpkgs
     nixpkgs:
-        - curl
+        - jq
+        - minisign
+        - dart-sass
+
+environment:
+    ZIG_VERSION: "0.15.1"
 
 steps:
-    - name: Setup
+    - name: Download Zig compiler
+      command: |
+          chmod +x zig/download.sh;
+          ./zig/download.sh;
+          ./zig/zig --version
+    - name: Download statichost cli
       command: |
           curl -o shcli https://www.statichost.eu/shcli; chmod +x shcli
-    - name: Build
+    - name: Build website
       command: |
-          TAR_OPTIONS="--no-same-owner" nix run .#build
+          ./zig/zig build
     - name: Upload
       command: |
           ./shcli altagos-dev ./zig-out/website

flake.nix

···
   }: let
     flake-utils = zig2nix.inputs.flake-utils;
   in (flake-utils.lib.eachDefaultSystem (system: let
-    # Fix zig to handle tar extraction in Docker containers
-    zigFixed = zig2nix.outputs.packages.${system}.zig-latest.overrideAttrs (oldAttrs: {
-      # Override the unpack phase to use --no-same-owner
-      unpackPhase = ''
-        runHook preUnpack
-
-        # Extract with --no-same-owner to avoid permission issues in Docker
-        tar xf $src --no-same-owner
-
-        # Set sourceRoot to the extracted directory
-        sourceRoot=$(ls -d */ | head -n 1)
-        sourceRoot=''${sourceRoot%/}
-
-        runHook postUnpack
-      '';
-    });
     # Zig flake helper
     # Check the flake.nix in zig2nix project for more options:
     # <https://github.com/Cloudef/zig2nix/blob/master/flake.nix>
-    # env = zig2nix.outputs.zig-env.${system} {zig = zig2nix.outputs.packages.${system}.zig-latest;};
-    env = zig2nix.outputs.zig-env.${system} {
-      zig = zigFixed; # Use the fixed zig instead of zig-latest
-    };
+    env = zig2nix.outputs.zig-env.${system} {zig = zig2nix.outputs.packages.${system}.zig-latest;};
     pkgs = nixpkgs.legacyPackages.${system};
   in
     with builtins;

zig/.gitignore

···
+*
+!download.sh
+!.gitignore

zig/download.sh

···
+#!/usr/bin/env bash
+set -e
+
+[ -z "$ZIG_VERSION" ] && ZIG_VERSION="master"
+
+ZIG_SIGNATUR_PUBKEY="RWSGOq2NVecA2UPNdBUZykf1CCb147pkmdtYxgb3Ti+JO/wCYvhbAb/U"
+
+command -v jq >/dev/null || { echo "Error: jq is required to parse Zig's download manifest"; exit 1; }
+command -v minisign >/dev/null || { echo "Error: minisign is required to verify Zig's signature"; exit 1; }
+mkdir -p zig
+
+case "$(uname -s)" in
+  Linux)
+    case "$(uname -m)" in
+      x86_64) p="x86_64-linux" ;;
+      aarch64) p="aarch64-linux" ;;
+      armv7l) p="arm-linux" ;;
+      i686) p="x86-linux" ;;
+      *) echo "Error: Unsupported architecture $(uname -m)"; exit 1 ;;
+    esac
+    ;;
+  Darwin)
+    case "$(uname -m)" in
+      x86_64) p="x86_64-macos" ;;
+      arm64) p="aarch64-macos" ;;
+      *) echo "Error: Unsupported architecture $(uname -m)"; exit 1 ;;
+    esac
+    ;;
+  *) echo "Error: Unsupported OS $(uname -s)"; exit 1 ;;
+esac
+
+u=$(curl -s https://ziglang.org/download/index.json | jq -r ".\"$ZIG_VERSION\".\"$p\".tarball")
+[ -z "$u" ] && { echo "Error: Could not find download URL for version $ZIG_VERSION on $p"; exit 1; }
+
+f=$(basename "$u")
+curl -L "$u" -o "zig/$f" || { echo "Error: Failed to download Zig compiler"; exit 1; }
+curl -L "$u.minisig" -o "zig/$f.minisig" || { echo "Error: Failed to download minisig signature"; exit 1; }
+
+minisign -Vm "zig/$f" -P $ZIG_SIGNATUR_PUBKEY || { echo "Error: Signature verification failed - this is critical for security"; exit 1; }
+
+[[ "$f" == *.zip ]] && unzip -q "zig/$f" -d zig && d=$(unzip -l "zig/$f" | awk 'NR==4 {print $4}' | cut -d '/' -f 1) || { tar -xJf "zig/$f" -C zig; d=$(tar -tf "zig/$f" | head -1 | cut -d '/' -f 1); }
+
+ln -sf "$(pwd)/zig/$d/zig" $(pwd)/zig/zig
+rm -f "zig/$f" "zig/$f.minisig"