opened
justaugustus
username_0
Please consider adding cryptographic digests for the [files released in this project][releases]. Commonly called SHA256SUMS files they can be easily generated using the common `sha256sum` tool on most systems

```
sha256sum * > SHA256SUMS
```

Alternatively, there [are some release automation tools][integrations] that can build these files automatically.

Besides being a useful practice for download verification I would also like to use the SHA256SUMS as a way to ensure the releases aren't tampered with and track when they are modified. There is a [tool called rget][rget] that can do this if you provide SHA256SUMS for your releases.

The rget tool also has a subcommand to make it easy to create SHA256SUMS for existing releases, just run:

```
rget github publish-release-sums https://github.com/REPLACE_ORG/REPLACE_PROJ/releases/tag/v2.0
```

Thanks!

[releases]: https://github.com/REPLACE_ORG/REPLACE_PROJ/releases
[integrations]: https://github.com/merklecounty/rget/blob/master/Documentation/integrations.md#release-automation
[rget]: https://github.com/merklecounty/rget#rget

/assign
/cc @username_1 @kubernetes/sig-release-admins @kubernetes/release-engineering 
/milestone v1.16
/priority important-longterm
/kind feature
Add Cryptographic Digests to GitHub Releases Body
issue
created
justaugustus
username_0
Phase 0 of this work is here: https://github.com/kubernetes/release/pull/849
comment
created
justaugustus
username_0
Original request from @username_1: https://github.com/kubernetes/kubernetes/issues/70132#issuecomment-518297891

Mailing list discussion: https://groups.google.com/d/msg/kubernetes-sig-release/R_-VwBk-JUo/-tQk-JzNAgAJ

cc: @dims
comment
created
justaugustus
username_0
Bookmark to notes from today's WG K8s Infra meeting: https://docs.google.com/document/d/16VBfsFMynA7tObzuZGPpw-sKDKfFc_T5W_E4IeEIaOQ/edit#bookmark=id.nrt4nqi4a038
comment
created
philips
username_1
This can be closed. rget is going to execute on a design to support arbitrary URLs https://github.com/merklecounty/rget/issues/10#issuecomment-555630002

/close
comment