Provide Checksums and Digital Signatures for Release Binaries

[dingchaoz]

To enhance the security and integrity of the Agave project’s releases, can we provide checksums and digital signatures for all distributed binaries? This practice allows users to verify the authenticity and integrity of the downloaded files, ensuring they have not been tampered with or corrupted during transmission.

Proposed Solution:

1.	Generate Checksums:
For each release artifact, compute a SHA-256 checksum.
Include these checksums in a file (e.g., SHA256SUMS) accompanying the release.
2.	Provide Digital Signatures:
Use a GPG key to sign the checksum file, creating a signature file (e.g., SHA256SUMS.asc).
Upload the public GPG key to a keyserver and provide its fingerprint in the release notes for user verification.
3.	Update Release Documentation:
Include instructions in the release notes on how users can verify the checksums and signatures.
Provide guidance on importing the GPG key and verifying the signature against the checksum file.

Implementing these measures will enhance user trust and security when downloading and using the Agave project’s binaries.