Pin the OpenVINO archive hashes and name the variables for what they hold

Check each OpenVINO download against a SHA-256 pinned next to its build,
instead of a .sha256 file fetched from the same server. When an archive is
missing, the server returns the same HTML page for both files, so the old check
compared nothing and failed with a confusing message. A pinned hash fails a
missing or replaced archive with "computed checksum did NOT match", keeps CI on
the exact archive it was tested with, and drops the second download.

Also set only the version, build and hash for each choice, and build the URL
and folder name once. The variables no longer say nightly, since the harness
pin is a release.

Author: shoumikhin

.ci/scripts/setup-openvino.sh

@@ -18,32 +18,25 @@ for arg in "$@"; do
   esac
 done
 
-# Download and install OpenVINO from release packages
-OPENVINO_VERSION="2026.0"
-OPENVINO_BUILD="2026.0.0.20965.c6d6a13a886"
-OPENVINO_STABLE_URL="https://storage.openvinotoolkit.org/repositories/openvino/packages/${OPENVINO_VERSION}/linux/openvino_toolkit_ubuntu22_${OPENVINO_BUILD}_x86_64.tgz"
-
-# OpenVINO deletes old nightly builds, so pin a release that contains what the
-# test harness needs instead of a nightly.
-OPENVINO_NIGHTLY_VERSION="2026.1"
-OPENVINO_NIGHTLY_BUILD="2026.1.0.21367.63e31528c62"
-OPENVINO_NIGHTLY_URL="https://storage.openvinotoolkit.org/repositories/openvino/packages/${OPENVINO_NIGHTLY_VERSION}/linux/openvino_toolkit_ubuntu22_${OPENVINO_NIGHTLY_BUILD}_x86_64.tgz"
-
+# Download and install OpenVINO from release packages. --nightly selects a newer
+# release rather than a nightly build, because OpenVINO deletes old nightlies.
 if [ "${USE_NIGHTLY}" = true ]; then
-  OPENVINO_URL="${OPENVINO_NIGHTLY_URL}"
-  OPENVINO_EXTRACTED_DIR="openvino_toolkit_ubuntu22_${OPENVINO_NIGHTLY_BUILD}_x86_64"
-  echo "Using OpenVINO release: ${OPENVINO_NIGHTLY_BUILD}"
+  OPENVINO_VERSION="2026.1"
+  OPENVINO_BUILD="2026.1.0.21367.63e31528c62"
+  OPENVINO_SHA256="3b4d92fec96860dfea844cd7c23e190d76c243e75815491d53405b4ced892103"
 else
-  OPENVINO_URL="${OPENVINO_STABLE_URL}"
-  OPENVINO_EXTRACTED_DIR="openvino_toolkit_ubuntu22_${OPENVINO_BUILD}_x86_64"
-  echo "Using OpenVINO stable release: ${OPENVINO_BUILD}"
+  OPENVINO_VERSION="2026.0"
+  OPENVINO_BUILD="2026.0.0.20965.c6d6a13a886"
+  OPENVINO_SHA256="3c99a294d1a12a96a945c56a3b27a099df885980f7667b996cff67b4ff3cf46a"
 fi
+OPENVINO_EXTRACTED_DIR="openvino_toolkit_ubuntu22_${OPENVINO_BUILD}_x86_64"
+OPENVINO_URL="https://storage.openvinotoolkit.org/repositories/openvino/packages/${OPENVINO_VERSION}/linux/${OPENVINO_EXTRACTED_DIR}.tgz"
+echo "Using OpenVINO release: ${OPENVINO_BUILD}"
 
 curl -Lo /tmp/openvino_toolkit.tgz --retry 3 --retry-all-errors --fail ${OPENVINO_URL}
 # The storage server answers a missing file with an HTML page and HTTP 200, so
-# check the archive against its published checksum before extracting it.
-curl -Lo /tmp/openvino_toolkit.tgz.sha256 --retry 3 --retry-all-errors --fail ${OPENVINO_URL}.sha256
-echo "$(cut -d ' ' -f 1 /tmp/openvino_toolkit.tgz.sha256)  /tmp/openvino_toolkit.tgz" | sha256sum --check
+# compare the download with the pinned hash before extracting it.
+echo "${OPENVINO_SHA256}  /tmp/openvino_toolkit.tgz" | sha256sum -c -
 tar -xzf /tmp/openvino_toolkit.tgz
 mv "${OPENVINO_EXTRACTED_DIR}" openvino