ci: msys2: pin boost to 1.86.0

[tobtoht]

• Boost >= 1.87.0 breaks builds (Add support for upcoming Boost 1.87.0 (Boost.Asio removals) #9596)
• MSYS2 ships Boost 1.87.0
• Temporary downgrade to get CI to pass until a proper fix is in place

[jeffro256]

Can we put an integrity check here please? Perhaps just a sha256sum or a PGP verify or something?

[x64x2]

ueh

[tobtoht]

Using sha256 hash verification instead of gpg, as the latter would allow an attacker that has access to the msys2 repo to trick us into installing any signed package.

Assuming the release signing key isn't compromised (in which case everything is compromised), this would effectively allow an attacker to cause an older version of Boost to be installed while still passing CI. The older version of Boost could have a vulnerability that is not present in 1.86.0, and someone could unwittingly decide to run this development build outside of a testing environment.

I'm also downgrading boost-libs here as this package is required by boost, and the versions should not mismatch.

Edit: Assuming the attacker has kept older copies of the signed db, there appears to be nothing stopping them from tricking us into installing older versions of other packages either. Again, this is a development build, so I don't really care.

Edit2: In fact, database signatures are optional by default (and msys2 does not configure it otherwise). If a signature is not present, pacman will not throw an error.

[selsta]

The files built don't get uploaded anyway so I don't think there is a legitimate attack vector here

[tobtoht]

Ah right, it's the depends build that gets uploaded as an artifact, not this one. So yeah, the purpose of this job is only to check if Monero successfully builds on msys2.