ci/woodpecker/pr/ci Pipeline was successful
Comment-only, no behaviour change. Both raised by scooby in the #1229 review as non-blocking findings worth writing down rather than fixing here. F-A: the SHASUMS256.txt check gives integrity, not authenticity. TLS to $NODE_DIST_BASE is the whole trust root, and MOSAIC_NODE_DIST_BASE widens it to any mirror with no signature backstop. GPG-verifying SHASUMS256.txt.sig is filed as its own follow-up so it gets its own review. F-C: the uname map pulls the glibc build, so musl hosts fail — visibly, via node_is_suitable, not silently.