internal/pkg: optionally measure exec artifact

Useful for verifying deterministic output without enabling network access.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/rosa/busybox.go

@@ -104,7 +104,7 @@ func newBusyboxBin() pkg.Artifact {
 	}
 
 	return pkg.NewExec(
-		"busybox-bin-"+version, arch, nil, pkg.ExecTimeoutMax, false,
+		"busybox-bin-"+version, arch, nil, pkg.ExecTimeoutMax, false, false,
 		fhs.AbsRoot, []string{
 			"PATH=/system/bin",
 		},

internal/rosa/git.go

@@ -111,7 +111,7 @@ func (t Toolchain) NewViaGit(
 	return t.New(strings.TrimSuffix(
 		path.Base(url),
 		".git",
-	)+"-src-"+path.Base(rev), 0, t.AppendPresets(nil,
+	)+"-src-"+path.Base(rev), THostNet, t.AppendPresets(nil,
 		NSSCACert,
 		Git,
 	), &checksum, nil, `

internal/rosa/rosa.go

@@ -220,6 +220,8 @@ const (
 	TEarly
 	// TNoToolchain excludes the LLVM toolchain.
 	TNoToolchain
+	// THostNet arranges for a [pkg.KindExecNet] to be created.
+	THostNet
 )
 
 var (
@@ -325,7 +327,9 @@ mkdir -vp /work/system/bin
 	}
 
 	return pkg.NewExec(
-		name, arch, knownChecksum, pkg.ExecTimeoutMax, flag&TExclusive != 0,
+		name, arch, knownChecksum, pkg.ExecTimeoutMax,
+		flag&THostNet != 0,
+		flag&TExclusive != 0,
 		fhs.AbsRoot, env,
 		AbsSystem.Append("bin", "sh"),
 		[]string{"sh", absCureScript.String()},
@@ -408,6 +412,9 @@ type Helper interface {
 
 // PackageAttr holds build-system-agnostic attributes.
 type PackageAttr struct {
+	// Measure output if populated. Required by [THostNet].
+	KnownChecksum *pkg.Checksum
+
 	// Mount the source tree writable.
 	Writable bool
 	// Do not pass through [Toolchain.NewPatchedSource].
@@ -545,7 +552,7 @@ cd '/usr/src/` + name + `/'
 		name+"-"+version,
 		attr.Flag,
 		extraRes,
-		nil,
+		attr.KnownChecksum,
 		attr.Env,
 		scriptEarly+helper.script(name),
 		slices.Concat(attr.Paths, []pkg.ExecPath{