workspace: verify downloaded toolchain artifacts

[d-sonuga]

No description provided.

[Copilot]

Pull request overview

Adds SHA-256 pinning and verification for downloaded toolchain artifacts used by the workspace scripts, ensuring downloaded compiler/wasm-tools archives are validated before extraction and use.

Changes:

• Introduces scripts/verify-artifact.sh to validate an artifact file against an expected SHA-256.
• Pins expected SHA-256 values for wasm-tools and duskc archives and verifies downloads before extraction.
• Adds extraction cache invalidation via .artifact.sha256 markers to force re-extraction when the pinned hash changes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
scripts/verify-artifact.sh	New helper script to verify artifact SHA-256 (sha256sum/shasum).
scripts/strip.sh	Pins/validates wasm-tools tarball and re-extracts when the expected hash changes.
scripts/setup-compiler.sh	Pins/validates compiler zip and re-unzips/re-extracts when the expected hash changes.

Comments suppressed due to low confidence (1)

scripts/setup-compiler.sh:85

• The tar extractions are backgrounded and then a bare wait is used. In POSIX sh, wait without PIDs returns the status of the last job to terminate, so earlier extraction failures can be missed and the script may continue with a partially extracted toolchain. Run the extractions sequentially (or track PIDs and check each exit code).

    tarballs=$(find "$UNZIPPED_DIR" -name '*.tar.gz')
    for tarball in $tarballs; do
        tar -xzf "$tarball" -C "$EXTRACTED_DIR" --strip-components=2 &
    done
    wait

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[HDauven]

LGTM, just a remark that can make it more robust.

[moCello]

COMMENT — Sound supply-chain hardening; the earlier curl/pipeline nits are fixed and the change is well-scoped. Neither finding blocks: the backgrounded tar + bare wait in setup-compiler.sh (warning) can cache a partial toolchain as hash-verified and is worth fixing before merge; the un-cleared bad artifact (note) is a recoverable papercut.