Ran into this when testing patches for bug 1364588. If you have downloaded a toolchain X with a `mach bootstrap` invocation, and the necessary toolchain hasn't changed, then re-invoking `mach bootstrap` will not re-download the toolchain (good) but will re-un-compress the downloaded toolchain to overwrite the existing one. I can see both good and bad sides to this, but this sort of behavior is decidedly less convenient than distribution package managers. If we're going to seriously consider downloading bits and pieces of the toolchains people need from taskcluster/tooltool, rather than using existing packages on their systems, we should make bootstrap do the minimum amount of work necessary here.

How do you know the extracted directory contains the right stuff?

We could save a manifest with hashes the first time we unpack and verify that. For me personally, it would be more helpful to have filenames under .mozbuild/toolchains so I can verify or remove bits manually without having to run things through tar.

The files don't have a useful filename because of tooltool cache compatibility (allows to reuse tooltool cache). The filenames will be more useful for files we take out of TC artifacts. That being said, the cache is also managed by the `mach artifact toolchain` command (it will remove old unused stuff), so you actually don't need to verify and remove bits manually.