[AI-generated] Make WASM and CI inputs verifiable and reproducible

[timonwong]

AI-generated issue: drafted and opened by AI Agent from the commit 7d7621314b73dec06255434e4cacce249de3d181.

Problem

The build claims pinned and reproducible inputs, but several supply-chain inputs are mutable or lack integrity verification:

• buildtools/wasm/Dockerfile:1 uses mutable debian:13-slim.
• buildtools/wasm/Dockerfile:6-9 installs unversioned apt packages.
• buildtools/wasm/Dockerfile:13-17 downloads ghc-wasm-meta without a checksum.
• buildtools/wasm/build.sh:21-22 downloads the pre-seeded fgl tarball without a checksum.
• scripts/fetch-native-shellcheck.sh:27-36 downloads the native parity binary without checksum or signature verification.
• .github/workflows/ci.yml:33-40 and release.yml:43-50 explicitly disable BuildKit provenance.

Impact

A changed upstream image, package, archive, or release asset can silently alter CI behavior or the published WASM artifact. npm provenance does not attest the separately built WASM asset.

Acceptance criteria

• Pin the base image by digest.
• Pin or snapshot apt inputs where practical.
• Verify ghc-wasm-meta, fgl, and native ShellCheck downloads with checksums or signatures.
• Enable verifiable build provenance and SBOM for the WASM build and publish it separately from the npm tarball.
• Add CI checks proving the recorded build metadata corresponds to the verified inputs.

[timonwong]

Closing: the two real gaps are fixed in #17, the rest are deliberate.

Fixed (#17):

• debian:13-slim pinned to its multi-arch index digest (buildtools/wasm/Dockerfile:1), with a Dependabot docker entry so the digest gets bumped instead of going stale.
• The pre-seeded fgl-5.8.3.1 tarball is verified with sha256sum -c (buildtools/wasm/build.sh:25); the hash matches commercialhaskell/all-cabal-hashes.

Not doing:

• ghc-wasm-meta checksum — the archive URL already carries the commit SHA, so the source tree is pinned.
• apt version pins — Debian drops old package versions from the mirrors, so pins break builds within weeks. Only snapshot.debian.org avoids that, and it is too slow and flaky for CI. The digest-pinned base image already fixes the package set.
• Native ShellCheck checksum — scripts/fetch-native-shellcheck.sh fetches the parity reference only; it never enters the artifact. Per-OS/arch hashes would also break the daily bump-shellcheck.yml PRs.
• provenance: false — buildx would otherwise write a SLSA provenance.json into dist/, which ships in the npm package. The flag disables that stray file, not the release's provenance: release.yml publishes through npm Trusted Publishing with npm publish --provenance. Attesting the separately distributed shellcheck.wasm asset would be actions/attest-build-provenance on the release step — a separate decision, not a gap this issue's premise identified.