[Bug]: Nightly builds are failing since March 29 (excl. March 30)

[James103]

Version of OpenTTD

Since e866ca8

Expected result

Nightly builds should build and publish for all platforms at the expected time.

Actual result

Since March 29 (excluding March 30), the nightly builds are failing in the CMake step with the following error:

  error: Failed to download from mirror set
  error: File does not have the expected hash:
  url: https://github.com/tukaani-project/xz/archive/v5.4.4.tar.gz
  File: /Users/runner/work/_temp/vcpkg/downloads/tukaani-project-xz-v5.4.4.tar.gz.4960.part
  Expected hash: c28461123562564e030f3f733f078bc4c840e87598d9f4b718d4bca639120d8133f969c45d7bdc62f33f081d789ec0f14a1791fb7da18515682bfe3c0c7362e0
  Actual hash: 6aff523efa48904b10f0d0adcee3ebe58a255512159d78f5352194404b23aa3c366688436d62680d832a87de0176fd5f792b676dd07a5bbbdf7564565c903eb8

where the offending part number and hash under "Actual hash" changes with each failing run.

This may be caused by the file being changed and re-uploaded upstream.

Steps to reproduce

Wait for the nightly build via GitHub Actions, then check the logs.
Most recent failing run: https://github.com/OpenTTD/OpenTTD/actions/runs/8532606077/job/23374030865

[glx22]

We are aware and we can't do anything about it.
In reaction to the discovery of a backdoor in xz util, xz repository has been disabled, so a dependency for the build can't be downloaded.

[kevinfields777]

More info on why the repository has been disabled, for those not aware:

https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/