Verify downloaded toolchain archives against sha256 checksums

[fresh-borzoni]

Context

erlef/setup-beam downloads OTP, Elixir, Gleam, and rebar3 via tc.downloadTool without verifying checksums. Flagged during ASF allowlist review for an Apache incubating project:

• INFRA: https://issues.apache.org/jira/browse/INFRA-27826
• ASF PR: Allow erlef/setup-beam v1.24.0 apache/infrastructure-actions#751

ASF maintainers agreed to allow the current SHA conditional on raising this issue.

Proposal

Two options:

A. Fetch-at-install. At download time, fetch the checksum upstream publishes (builds.txt for hex.pm, .sha256 sibling for Gleam) and verify. Same-origin, so doesn't beat a fully-compromised mirror, but catches corruption and partial tampering. Covers OTP linux + Elixir + Gleam (3 of 6 paths). Darwin can be covered with sig-store potentially. No ongoing maintenance.

B. Pinned KNOWN_CHECKSUMS (à la astral-sh/setup-uv). Pin hashes in source via a committed map + weekly regeneration workflow. Cross-origin, covers all 6 paths. ~300 entries for supported versions.

Questions

• Which direction fits the project?
• Concerns about maintenance for option B?

[ppkarwasz]

For option B the action can always add a checksum input that will allow users to provide a checksum for versions that were not yet embedded into the action.

Some of the artifacts, published to GitHub Releases, have SigStore signatures. For those it might be enough to check those signatures.

[maennchen]

Related: hexpm/bob#237