Pin the OpenVINO test harness to a release instead of a deleted nightly

The OpenVINO test-harness jobs have failed every night since mid-September.
The setup script downloads a pinned OpenVINO nightly, and OpenVINO has since
deleted it. The storage server answers the missing file with an HTML page and
HTTP 200, so curl --fail does not catch it and the job dies in tar with
"gzip: stdin: not in gzip format".

Point the --nightly path at the official 2026.1.0 release, which contains all
of the old nightly's commits and is not deleted. Also check each download
against the .sha256 file OpenVINO publishes next to it, so a missing or broken
download fails right away instead of in tar.

Author: shoumikhin

.ci/scripts/setup-openvino.sh

@@ -23,21 +23,27 @@ OPENVINO_VERSION="2026.0"
 OPENVINO_BUILD="2026.0.0.20965.c6d6a13a886"
 OPENVINO_STABLE_URL="https://storage.openvinotoolkit.org/repositories/openvino/packages/${OPENVINO_VERSION}/linux/openvino_toolkit_ubuntu22_${OPENVINO_BUILD}_x86_64.tgz"
 
-OPENVINO_NIGHTLY_BUILD_ID="2026.1.0-21310-c694fbc2b6d"
-OPENVINO_NIGHTLY_BUILD="2026.1.0.dev20260312"
-OPENVINO_NIGHTLY_URL="https://storage.openvinotoolkit.org/repositories/openvino/packages/nightly/${OPENVINO_NIGHTLY_BUILD_ID}/openvino_toolkit_ubuntu22_${OPENVINO_NIGHTLY_BUILD}_x86_64.tgz"
+# OpenVINO deletes old nightly builds, so pin a release that contains what the
+# test harness needs instead of a nightly.
+OPENVINO_NIGHTLY_VERSION="2026.1"
+OPENVINO_NIGHTLY_BUILD="2026.1.0.21367.63e31528c62"
+OPENVINO_NIGHTLY_URL="https://storage.openvinotoolkit.org/repositories/openvino/packages/${OPENVINO_NIGHTLY_VERSION}/linux/openvino_toolkit_ubuntu22_${OPENVINO_NIGHTLY_BUILD}_x86_64.tgz"
 
 if [ "${USE_NIGHTLY}" = true ]; then
   OPENVINO_URL="${OPENVINO_NIGHTLY_URL}"
   OPENVINO_EXTRACTED_DIR="openvino_toolkit_ubuntu22_${OPENVINO_NIGHTLY_BUILD}_x86_64"
-  echo "Using OpenVINO nightly build: ${OPENVINO_NIGHTLY_BUILD_ID}"
+  echo "Using OpenVINO release: ${OPENVINO_NIGHTLY_BUILD}"
 else
   OPENVINO_URL="${OPENVINO_STABLE_URL}"
   OPENVINO_EXTRACTED_DIR="openvino_toolkit_ubuntu22_${OPENVINO_BUILD}_x86_64"
   echo "Using OpenVINO stable release: ${OPENVINO_BUILD}"
 fi
 
 curl -Lo /tmp/openvino_toolkit.tgz --retry 3 --retry-all-errors --fail ${OPENVINO_URL}
+# The storage server answers a missing file with an HTML page and HTTP 200, so
+# check the archive against its published checksum before extracting it.
+curl -Lo /tmp/openvino_toolkit.tgz.sha256 --retry 3 --retry-all-errors --fail ${OPENVINO_URL}.sha256
+echo "$(cut -d ' ' -f 1 /tmp/openvino_toolkit.tgz.sha256)  /tmp/openvino_toolkit.tgz" | sha256sum --check
 tar -xzf /tmp/openvino_toolkit.tgz
 mv "${OPENVINO_EXTRACTED_DIR}" openvino