binary: add sha256 checksum to downloads

[johanneslarsson]

Adds sha256 checksum to all binaries

These checksums can be used to verify file integrity.

Fixes #3448

[srenatus]

✔️ So in this PR, the GHA binaries.zip already contains the checksums and they're OK.
✔️ Via this workflow, those shasums should end up on the github release, too.

Traditionally, anything touching the release process breaks the release process. 😅 But lets merge this and deal with that when we get there.

Could you fix DCO or just squash it all into one commit, please?

[johanneslarsson]

✔️ So in this PR, the GHA binaries.zip already contains the checksums and they're OK. ✔️ Via this workflow, those shasums should end up on the github release, too.

Traditionally, anything touching the release process breaks the release process. 😅 But lets merge this and deal with that when we get there.

Could you fix DCO or just squash it all into one commit, please?

I'm quite sure I probably missed something 😅, but these changes was the obvious ones.

[johanneslarsson]

I read in the issue that checksums where wanted in the release notes, but I'm not sure how it would work.

[srenatus]

I read in the issue that checksums where wanted in the release notes, but I'm not sure how it would work.

I suppose we could adapt the github release script (that creates the draft release for each push of a tag) to also generate a draft message that would include the checksums. It would then be the starting point, and the manually created release notes would be paste above it or something.

But also we can worry about that next. (From a security perspective, I'm not sure I understand the difference between having the shasums in assets vs having them mentioned in the release notes. I think if you have the privilege to change one of them, you likely have it to change the other, too. I might be missing something, though.)

[srenatus]

Unrelated netlify failure... I've retried the deployment.

[johanneslarsson]

I read in the issue that checksums where wanted in the release notes, but I'm not sure how it would work.

I suppose we could adapt the github release script (that creates the draft release for each push of a tag) to also generate a draft message that would include the checksums. It would then be the starting point, and the manually created release notes would be paste above it or something.

But also we can worry about that next. (From a security perspective, I'm not sure I understand the difference between having the shasums in assets vs having them mentioned in the release notes. I think if you have the privilege to change one of them, you likely have it to change the other, too. I might be missing something, though.)

Yes, I agree.

[johanneslarsson]

Unrelated netlify failure... I've retried the deployment.

I'll re-phrase my doc change to trigger a retry

[srenatus]

Thanks again!

I'm afraid I might not have the proper AWS keys to fix this if there's any fallout, so let's get this merged when people with 🔑 are online 😅

[tsandall]

@johanneslarsson this looks good to me. Thanks! I'll merge now and then verify the release automation is working.