curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write

Summary: The curl CLI's `--skip-existing` option performs a separate existence check before the download body is written. In the verified path, curl first calls `stat()` on the target pathname and decides "the file does not exist, so continue", but it does not keep an fd bound to that decision. The …

set -euo pipefail

ROOT="$PWD"
CURL_BIN=""
for candidate in "$ROOT/src/curl" "$ROOT/build-h2-asan/src/curl" "$(command -v curl)"; do
  if [ -n "${candidate:-}" ] && [ -x "$candidate" ]; then
    CURL_BIN="$candidate"
    break
  fi
done
if [ -z "$CURL_BIN" ]; then
  echo "could not find a curl …