sha256 sums for OVAs + download integrity

(filing this issue here, since it crosses a couple of repos)

We made the decision back in 2019 to not compress OVA artifacts as part of cosa compress

One of the side effects of this was that the meta.json doesn't have an uncompressed-sha256 entry for the OVA:

$ cat meta.json | jq .images.vmware
{
  "path": "rhcos-411.85.202203181601-0-vmware.x86_64.ova",
  "sha256": "a39054725aea870a929046abcdfd897e61763e2556844e47bb87492c4367cb74",
  "size": 1118535680,
  "skip-compression": true
}

Consequently, the stream metadata for the RHCOS builds are also missing this entry:

$ curl -Ls https://raw.githubusercontent.com/openshift/installer/master/data/data/coreos/rhcos.json | jq .architectures.x86_64.artifacts.vmware
{
  "release": "410.84.202201251210-0",
  "formats": {
    "ova": {
      "disk": {
        "location": "https://rhcos-redirector.apps.art.xq1c.p1.openshiftapps.com/art/storage/releases/rhcos-4.10/410.84.202201251210-0/x86_64/rhcos-410.84.202201251210-0-vmware.x86_64.ova",
        "sha256": "3d75bcf4d1245f1d10865072b3a735333f2fbc7262b55fafc0fbead8c8c3517d"
      }
    }
  }
}

Which in turn means that the openshift/installer code does not append any sha256 sum when generating URIs for the OVAs:

https://github.com/openshift/installer/blob/6d778f911e79afad8ba2ff4301eda5b5cf4d8e9e/pkg/rhcos/builds.go#L50-L63

I believe this may contribute to problems like https://bugzilla.redhat.com/show_bug.cgi?id=2065849 where the download is not verified and then causes problems when vSphere tries to ingest the OVA.

So this is kind of a broad issue to discuss if there are improvements/changes we should consider for the OVA case.

• Perhaps we duplicate the sha256 entry for OVAs as uncompressed-sha256?
• Perhaps we remove the sha256 entry and replace it with uncompressed-sha256?
• Perhaps we modify the installer code to use the sha256 entry if there is no uncompressed-sha256 entry?

Start by comparing cosa compress output in meta.json with OVA handling in openshift/installer/pkg/rhcos/builds.go, using the linked examples as the baseline. Trace how stream metadata becomes installer download URIs and review the five-comment discussion before choosing a checksum contract. Done means the OVA metadata and generated URI behavior consistently support download integrity.