feat(rust): validate download checksum and prefer xz compression (#2250)

feat(rust): validate download checksum

src/usr/local/containerbase/tools/v2/rust.sh

@@ -11,7 +11,13 @@ function install_tool () {
   local versioned_tool_path
   local file
   local arch
+  local base_url
+  local checksum_file
+  local expected_checksum
+  local ext=gz
+  local file_name
   local tool_path
+
   tool_path=$(find_tool_path)
 
   if [[ ! -d "${tool_path}" ]]; then
@@ -24,7 +30,22 @@ function install_tool () {
   fi
 
   arch=$(uname -p)
-  file=$(get_from_url "https://static.rust-lang.org/dist/rust-${TOOL_VERSION}-${arch}-unknown-linux-gnu.tar.gz")
+  file_name="rust-${TOOL_VERSION}-${arch}-unknown-linux-gnu.tar"
+  base_url="https://static.rust-lang.org/dist/${file_name}"
+
+  # not all releases have checksums
+  if [[ $(file_exists "${base_url}.xz.sha256") == "200" ]]; then
+    checksum_file=$(get_from_url "${base_url}.xz.sha256")
+    # get checksum from file
+    expected_checksum=$(cut -d' ' -f1  "${checksum_file}")
+    ext=xz
+  else
+    checksum_file=$(get_from_url "${base_url}.gz.sha256")
+    # get checksum from file
+    expected_checksum=$(cut -d' ' -f1  "${checksum_file}")
+  fi
+
+  file=$(get_from_url "${base_url}.${ext}" "${file_name}.${ext}" "${expected_checksum}" "sha256sum")
   mkdir -p "${TEMP_DIR}/rust"
   bsdtar --strip 1 -C "${TEMP_DIR}/rust" -xf "${file}"
   versioned_tool_path=$(create_versioned_tool_path)