Stop bundling the Linaro UEFI firmware for ARM64

[jacob-carlborg]

Problem

Qemu::Arm64#bundle_uefi downloaded linaro_uefi.fd from
https://releases.linaro.org/components/kernel/uefi-linaro/latest/release/qemu64/QEMU_EFI.fd.
That host has been retired: the URL now 302-redirects to
https://www.linaro.org/contact/, which answers with HTTP 200 and an HTML
body. download_file used URI.open and wrote whatever it received without
validation, so the 1.1.0 build silently bundled a 49381-byte HTML page
("Contact | Linaro") as share/qemu/linaro_uefi.fd (the correct file in 1.0.0
is 2097152 bytes).

Arm64OpenBsd in cross-platform-actions/action is the only consumer of that
firmware, so every OpenBSD ARM64 job fails.

test.rb did not catch it because the firmware assertions only checked that
the files were present in the tarball.

Changes

• Drop the Linaro firmware entirely. OpenBSD ARM64 no longer needs it:
  Boot OpenBSD on ARM64 with the shared EDK II UEFI firmware action#160 boots it on the shared edk2 uefi.fd by
  setting the machine type to virt,acpi=off. edk2 publishes ACPI tables and
  OpenBSD 7.x/arm64 hangs during ACPI attach; suppressing them makes the kernel
  fall back to the device tree, which is exactly what the old Linaro build
  offered. With no consumer left there is nothing to download and nothing to
  vendor, so bundle_linaro_uefi, linaro_uefi_target_path and the
  linaro_uefi.fd entry in the arm64 firmware list are gone.
• download_file fails loudly. It raises on a non-success HTTP status and
  on an HTML body (by Content-Type or by sniffing the leading bytes), and
  writes the destination only after validation, in binary mode. The check is
  generic, so the riscv64 U-Boot .deb download is protected too.
• test.rb checks firmware contents. A new FirmwareValidator reads every
  share/qemu/* entry out of the bundle and asserts it is at least 4 KiB and
  not an HTML document. Applied to x86_64, arm64 and riscv64.

This is a behavioural change for consumers of the tarball, so the changelog
records it under Removed: qemu-system-aarch64-*.tar no longer contains
share/qemu/linaro_uefi.fd.

Depends on cross-platform-actions/action#160 — that PR must ship for OpenBSD
ARM64 to keep booting once a release cut from this branch is consumed.

Verification

The full suite needs built QEMU artifacts, so it cannot run locally.
ruby -c ci.rb and ruby -c test.rb both report Syntax OK.

The bundle assertions were run against three synthetic
qemu-system-aarch64-macos.tar fixtures:

Fixture	File structure	Firmware contents
efi-e1000.rom, efi-virtio.rom, uefi.fd	pass	pass
the above plus an HTML linaro_uefi.fd	fail — +share/qemu/linaro_uefi.fd	fail — 'linaro_uefi.fd' is an HTML document, not firmware
uefi.fd truncated to 512 bytes	pass	fail — 'uefi.fd' is 512 bytes, expected at least 4096

The second row confirms both that the arm64 expectations no longer list
linaro_uefi.fd and that an unexpected extra firmware in the bundle is now a
failure.

The hardened download_file was exercised against a local HTTP server:

Response	Result
200, application/octet-stream, 64 KiB binary	written, bytes match
200, text/html	raises "expected a file, got an HTML document", no file
200, application/octet-stream, HTML body	raises "expected a file, got an HTML document", no file
302 to a 200 text/html page	raises "expected a file, got an HTML document", no file
404	raises OpenURI::HTTPError, no file

🤖 Generated with Claude Code