Checksums should be verified for downloaded artifacts

[Edholm]

Many GitHub releases also publish a checksum file. Sage could, if that file is available, also download it and verify the downloaded artifact against the checksum.

This is useful when downloading over a shaky connection (e.g. train).

An example of a release that also publish a checksum file: https://github.com/golangci/golangci-lint/releases/tag/v1.44.2

[github-actions]

This issue has been open for 365 days with no activity. Marking as stale.