Verify the checksum of the downloaded KSON binary when building Rust crate

[aochagavia]

Someone pointed out on HN that downloading a precompiled library from GitHub, without any hash verification, is a security risk. That's a good catch! We should actually verify the binary after downloading.

[aochagavia]

Hey @comex, hope you don't mind an unexpected ping! About two weeks ago you wrote the comment that led me to create this issue, so I thought I'd ask you for help. I haven't dealt with binary distribution in the past and you seem to know your stuff, so I was hoping you could lend us a hand.

In your comment, you implied that it's undesirable to have the kson-rs crate download a precompiled library from GitHub without hash verification. Right now I see the following possible fixes:

1. Let the build.rs script also download the hash from GitHub, to verify the file was not corrupted during the download. I'd say this is more robust than what we have today, but I don't think it improves our security posture. Anyone who controls the file can also control the hash (they are both obtained from the same GitHub repository).
2. Embed the hash in the build.rs script and verify the downloaded file matches what we expect. This does improve security, because controlling the GitHub repository is no longer enough to compromise a user of the library. An attacker would need to also control the published crate on crates.io. I don't think I've seen this approach in the wild, though, so maybe there are downsides that make it impractical (e.g. releasing a new version of the binary would require releasing a new version of the crate, since the hash would change).
3. Use public key cryptography to do something more elaborate (not sure exactly what, but I've read that signed releases are a thing).

Is there any specific approach you'd recommend?