Verify SHA256 checksums when installing Ruby from rv-ruby

[shaanmajid]

rv downloads precompiled Ruby tarballs from rv-ruby and extracts them without any integrity check. A tampered tarball installs silently.

Blocked by: spinel-coop/rv-ruby#54

Proposed changes

1. Fetch or embed the SHA256SUMS file from the rv-ruby release
2. Verify the downloaded tarball's SHA256 before extraction
3. Fail with a clear error on mismatch

Prior art

uv does this for python-build-standalone. At build time, a script collects SHA256 hashes from GitHub release assets (via the API digest field or SHA256SUMS files) and writes them into a JSON metadata file compiled into the binary via include_bytes!. At install time, uv wraps the download stream in a HashReader that computes SHA256 during extraction, then compares against the compiled-in hash. On mismatch it refuses to install. rv could take a similar approach or start simpler by fetching and verifying SHA256SUMS at install time.

[shaanmajid]

Willing to put in a PR for this if spinel-coop/rv-ruby#54 gets merged

[indirect]

Thanks for offering! I like the idea of having checksums baked into the binary, but it seems like they will often be out of date for e.g. daily builds, or new releases. So we'll need the code to fetch checksums and verify them first.