Add Cryptographic Digests to GitHub Releases Body

[justaugustus]

Please consider adding cryptographic digests for the files released in this project. Commonly called SHA256SUMS files they can be easily generated using the common sha256sum tool on most systems

sha256sum * > SHA256SUMS

Alternatively, there are some release automation tools that can build these files automatically.

Besides being a useful practice for download verification I would also like to use the SHA256SUMS as a way to ensure the releases aren't tampered with and track when they are modified. There is a tool called rget that can do this if you provide SHA256SUMS for your releases.

The rget tool also has a subcommand to make it easy to create SHA256SUMS for existing releases, just run:

rget github publish-release-sums https://github.com/REPLACE_ORG/REPLACE_PROJ/releases/tag/v2.0

Thanks!

---

Additional tracking issues:

• Onboarding Kubernetes to rget: onboarding: adding kubernetes to the project merklecounty/rget#33
• audit log watch to gpg key signing subcommand: audit log watch to gpg key signing subcommand merklecounty/rget#34

/assign
/cc @philips @kubernetes/sig-release-admins @kubernetes/release-engineering
/milestone v1.16
/priority important-longterm
/kind feature

[justaugustus]

Phase 0 of this work is here: #849

[justaugustus]

Original request from @philips: https://github.com/kubernetes/kubernetes/issues/70132#issuecomment-518297891

Mailing list discussion: https://groups.google.com/d/msg/kubernetes-sig-release/R_-VwBk-JUo/-tQk-JzNAgAJ

cc: @dims

[justaugustus]

Bookmark to notes from today's WG K8s Infra meeting: https://docs.google.com/document/d/16VBfsFMynA7tObzuZGPpw-sKDKfFc_T5W_E4IeEIaOQ/edit#bookmark=id.nrt4nqi4a038

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[philips]

This can be closed. rget is going to execute on a design to support arbitrary URLs merklecounty/rget#10 (comment)

/close

[k8s-ci-robot]

@philips: Closing this issue.

In response to this:

This can be closed. rget is going to execute on a design to support arbitrary URLs merklecounty/rget#10 (comment)

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.