chore: update dependency download mirrors to reliable sources

[d0wn3d]

Issue being fixed or feature implemented

Update download URLs for boost, expat, gmp, qrencode, and zlib packages to use more reliable and maintained sources, replacing deprecated or unstable mirrors (bintray, sourceforge, etc.) with GitHub releases, GNU FTP, and official archives.

What was done?

Mirror links updated for the following packages:

• boost: Changed from https://dl.bintray.com/boostorg/release/1.64.0/source/ to https://archives.boost.io/release/1.64.0/source/

  • Normalized version format from 1_64_0 to 1.64.0
  • Updated file name to use version substitution

• expat: Changed from https://downloads.sourceforge.net/project/expat/expat/2.2.1 to https://github.com/libexpat/libexpat/releases/download/R_2_2_1/

• gmp: Changed from https://gmplib.org/download/gmp to https://ftp.gnu.org/gnu/gmp

• zlib: Changed from http://www.zlib.net to https://www.zlib.net/fossils/ (HTTPS and specific version archive)

How Has This Been Tested?

The changes were tested by running the following commands inside the /depends/ folder:

• Download for all platforms (macOS, Linux, Windows):

  make download

• Verify existing downloads:

  make check-sources

Test Results:
All packages downloaded successfully and SHA256 checksums verified:

• ✅ boost 1.64.0 - Downloaded and verified
• ✅ expat 2.2.1 - Downloaded and verified
• ✅ gmp 6.1.2 - Downloaded and verified
• ✅ zlib 1.2.11 - Downloaded and verified
• ✅ All other dependencies (openssl, libevent, zeromq, protobuf, qt, bdb, miniupnpc, etc.)

Breaking Changes

None - All SHA256 hashes remain valid as the files themselves have not changed, only the download sources.

Checklist:

Go over all the following points, and put an x in all the boxes that apply.

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation
• I have assigned this pull request to a milestone (for repository code-owners and collaborators only)

Summary by CodeRabbit

• Chores
  • Updated download sources and archive naming/version formatting for several third‑party libraries (Boost, Expat, GMP, Zlib) to use updated upstream locations and consistent version syntax.
• Bug Fixes
  • Corrected QRencode configure options to remove a malformed option and ensure proper configure behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a9c20d38-ea99-4f07-9c39-8b5aac491b30

📥 Commits

Reviewing files that changed from the base of the PR and between b840ab4 and 5cff21f.

📒 Files selected for processing (5)

• depends/packages/boost.mk
• depends/packages/expat.mk
• depends/packages/gmp.mk
• depends/packages/qrencode.mk
• depends/packages/zlib.mk

✅ Files skipped from review due to trivial changes (4)

• depends/packages/gmp.mk
• depends/packages/zlib.mk
• depends/packages/expat.mk
• depends/packages/boost.mk

🚧 Files skipped from review as they are similar to previous changes (1)

• depends/packages/qrencode.mk

---

📝 Walkthrough

Walkthrough

Updated download sources and version metadata for five dependency packages. Boost, Expat, GMP, and Zlib now point to different stable mirrors; Boost's version format changed to dotted form. Qrencode had a command-line option spacing correction.

Changes

Cohort / File(s)	Summary
Boost depends/packages/boost.mk	Changed boost_version from 1_64_0 to 1.64.0, switched boost_download_path to https://archives.boost.io/release/$($(boost)_version)/source/, and adjusted archive filename construction to boost_$(subst .,_,$($(package)_version)).tar.bz2.
Expat depends/packages/expat.mk	Switched expat download path from SourceForge to GitHub Releases: https://github.com/libexpat/libexpat/releases/download/R_$(subst .,_,$($(expat)_version))/.
GMP depends/packages/gmp.mk	Updated GMP download base from https://gmplib.org/download/gmp to https://ftp.gnu.org/gnu/gmp.
Zlib depends/packages/zlib.mk	Changed zlib download path from http://www.zlib.net to https://www.zlib.net/fossils/. File name and SHA256 unchanged.
Qrencode depends/packages/qrencode.mk	Fixed qrencode configure options spacing/order: --disable-shared --without-tools --disable-sdltest (was --disable-shared -without-tools --disable-sdltest).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 I nibbled URLs and made them neat,

dots for Boost and mirrors complete,
Expat hopped to GitHub's door,
GMP and zlib found new shore,
qrencode's flags now step in beat.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: update dependency download mirrors to reliable sources' accurately and clearly summarizes the main objective of the pull request—updating download URLs for multiple dependency packages to more stable sources.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}