There’s currently no official way to retrieve a canister’s wasm. A few weeks ago there was some discussion about adding a setting to canisters to have their wasm downloaded, but I can’t find it anymore.
I see two main workarounds:
- what you already described, manually uploading the wasm to stable memory. Has all the drawbacks you described, but it is possible to verify that the wasm matches by installing the wasm and comparing module hashes. If you expose the wasm publicly, anyone can do that.
- probably not suited for your use case: Use canister metadata to point to how the wasm can be obtained, again verified by comparing module hashes. See this thread for more info on that approach: [RFC] Canister Metadata Standard