Bind Geofabrik downloads to resolved mirrors

scripts/download-geofabrik.sh

@@ -18,6 +18,10 @@ fi
 mkdir -p "$OUT_DIR"
 
 for region in "${regions[@]}"; do
+  if [[ ! "$region" =~ ^[a-z0-9-]+$ ]]; then
+    echo "Invalid Geofabrik region: $region" >&2
+    exit 1
+  fi
   file_name="${region}-latest.osm.pbf"
   case "$region" in
     germany|netherlands)
@@ -33,9 +37,10 @@ for region in "${regions[@]}"; do
   download_part="${target}.part"
   download_part_checksum="${download_part}.expected-md5"
 
-  # Resolve the `latest` PBF redirect first and fetch the checksum belonging to
-  # that exact dated snapshot. This prevents transparent download proxies from
-  # combining a fresh PBF redirect with a stale `latest` checksum.
+  # Resolve the effective `latest` endpoint first and fetch its checksum from
+  # the same mirror. Some Geofabrik mirrors keep `latest` in the effective URL
+  # while the checksum names the dated snapshot; both forms remain bound by
+  # the checksum verification before the active PBF is replaced.
   resolved_url="$(
     curl \
       --fail \
@@ -52,7 +57,8 @@ for region in "${regions[@]}"; do
   )"
   resolved_url="${resolved_url%%\?*}"
   resolved_file_name="${resolved_url##*/}"
-  if [[ "$resolved_file_name" =~ ^[a-z0-9-]+-[0-9]{6}\.osm\.pbf$ ]]; then
+  if [[ "$resolved_file_name" == "$file_name" ||
+        "$resolved_file_name" =~ ^${region}-[0-9]{6}\.osm\.pbf$ ]]; then
     download_url="$resolved_url"
   else
     download_url="$url"
@@ -78,9 +84,16 @@ for region in "${regions[@]}"; do
   fi
 
   checksum_file_name="$(awk 'NR == 1 { name = $2; sub(/^\*/, "", name); print name }' "$checksum_download")"
-  if [[ "$checksum_file_name" =~ ^[a-z0-9-]+-[0-9]{6}\.osm\.pbf$ ]] &&
-    [[ "$checksum_file_name" != "${download_url##*/}" ]]; then
-    echo "Checksum file does not match resolved snapshot: $checksum_file_name" >&2
+  download_file_name="${download_url##*/}"
+  if [[ "$download_file_name" =~ ^${region}-[0-9]{6}\.osm\.pbf$ ]]; then
+    if [[ "$checksum_file_name" != "$download_file_name" ]]; then
+      echo "Checksum file does not match resolved snapshot: $checksum_file_name" >&2
+      exit 1
+    fi
+  elif [[ "$download_file_name" == "$file_name" ]] &&
+    [[ "$checksum_file_name" != "$file_name" &&
+      ! "$checksum_file_name" =~ ^${region}-[0-9]{6}\.osm\.pbf$ ]]; then
+    echo "Checksum does not identify requested region: $checksum_file_name" >&2
     exit 1
   fi