Verify a vendored or fetched upstream file against its pinned commit via raw URL + md5

To confirm that a local copy of an upstream file (e.g. an open-source CPU core used inside your design) is byte-identical to the commit you claim in README/NOTICE, fetch the file directly at that commit with curl -sL https://raw.githubusercontent.com/OWNER/REPO/<commit>/<path> into a fresh temp dir, then compare hashes (md5 -q on macOS, md5sum on Linux). Short SHAs work in raw URLs. This is much cheaper than cloning, and it catches local patches someone forgot to mention before you publish an attribution claim. Do it on every copy that went into published results (each host), not just the canonical one, because an unnoticed patched copy makes the 'unmodified upstream' claim false.