feat: enhance dependency management with fallback URLs and download functionality

scripts/README.md

@@ -63,6 +63,8 @@ Only raw model parsing is shared with the NPU compiler. Run
 `make CONFIG=configs/ci/ihp130.mk npu-p0-qualify` after
 `make CONFIG=configs/ci/ihp130.mk setup-npu-reference` to compare both complete
 1000-input corpora against the Python graph reference and compiled executor.
+The VWW archive is fetched from the ordered HTTPS URLs in the dependency lock;
+every mirror must produce the same locked SHA-256 before extraction.
 The selected variant's `npu/p0/` directory retains oracle build provenance,
 per-input golden tensors, three-way hashes, logs and `qualification-p0.json`.
 The runner uses at most 16 workers (`JOBS`); missing sources/tools, numerical

scripts/dependency_lock.py

@@ -82,6 +82,16 @@ def _validate_archive(kind: str, name: str, value: dict[str, Any]) -> None:
     _require_fields(kind, name, value, ("url", "sha256", "destination", "license"))
     _validate_sha(f"{kind} {name}", value["sha256"])
     _validate_url(f"{kind} {name}", value["url"])
+    fallback_urls = value.get("fallback_urls", [])
+    if not isinstance(fallback_urls, list):
+        raise LockError(f"{kind} {name} fallback_urls must be a list")
+    for index, url in enumerate(fallback_urls):
+        if not isinstance(url, str):
+            raise LockError(f"{kind} {name} fallback_urls must contain URLs")
+        _validate_url(f"{kind} {name} fallback_urls[{index}]", url)
+    urls = [value["url"], *fallback_urls]
+    if len(set(urls)) != len(urls):
+        raise LockError(f"{kind} {name} download URLs must be unique")
     _validate_relative_path(f"{kind} {name} destination", value["destination"])
 
 

scripts/setup_helpers.py

@@ -148,6 +148,38 @@ def download_file(
     raise RuntimeError(f"failed to download {url}: {last_error}")
 
 
+def download_file_from_urls(
+    urls: Iterable[str],
+    destination: Path,
+    expected_sha256: str,
+    *,
+    update: bool = False,
+    retries: int = 3,
+    timeout: int = 30,
+    resume: bool = False,
+) -> None:
+    candidates = tuple(urls)
+    if not candidates:
+        raise ValueError("at least one download URL is required")
+    failures: list[str] = []
+    for url in candidates:
+        try:
+            download_file(
+                url,
+                destination,
+                expected_sha256,
+                update=update,
+                retries=retries,
+                timeout=timeout,
+                resume=resume,
+            )
+            return
+        except RuntimeError as error:
+            failures.append(str(error))
+            print(f"[dependency] mirror failed: {url}: {error}")
+    raise RuntimeError("all download mirrors failed: " + "; ".join(failures))
+
+
 def atomic_write(path: Path, content: str) -> bool:
     path = path.resolve()
     if path.exists() and path.read_text(encoding="utf-8") == content:

scripts/setup_npu_reference.py

@@ -14,7 +14,12 @@ ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT))
 
 from scripts.dependency_lock import archive, source  # noqa: E402
-from scripts.setup_helpers import atomic_write, download_file, ensure_git_repo, sha256  # noqa: E402
+from scripts.setup_helpers import (  # noqa: E402
+    atomic_write,
+    download_file_from_urls,
+    ensure_git_repo,
+    sha256,
+)
 
 MLCOMMONS_TINY = "apu_mlperf_tiny"
 KWS_MFCC = "apu_kws_mfcc"
@@ -151,7 +156,10 @@ def install(build_dir: Path, *, update: bool) -> dict[str, object]:
         ensure_git_repo(spec["url"], ROOT / spec["destination"], spec["revision"], update=update)
     dataset = archive(VWW_DATASET)
     archive_path = ROOT / dataset["destination"]
-    download_file(dataset["url"], archive_path, dataset["sha256"], update=update, timeout=600)
+    urls = (dataset["url"], *dataset.get("fallback_urls", ()))
+    download_file_from_urls(
+        urls, archive_path, dataset["sha256"], update=update, timeout=600
+    )
 
     models = verify_models(tiny)
     kws_names = verify_kws_features(mfcc)