Attach checksums to Releases

[edenreich]

Summary

This is more of a minor priority right now, but I'll keep it here in the backlog.

To enhance the security and integrity of releases, should add checksums for the release artifacts. This will allow users to verify that the files they download have not been tampered with.

Details

Current release Artifacts contains:
kopgen_aarch64-apple-darwin
kopgen_aarch64-unknown-linux-musl
kopgen_x86_64-apple-darwin
kopgen_x86_64-unknown-linux-gnu

Checksums to Include:
checksums.txt: Contains SHA256 checksums of the release artifacts.
checksums.txt.sig: A GPG signature of the checksums file.
checksums.txt.pem: The public key for verifying the signature.

Steps

Generate SHA256 checksums for the release artifacts.
Sign the checksums.txt file with GPG to create checksums.txt.sig.
Export the public key to checksums.txt.pem.
Update the release workflow to include these files.
This will ensure the authenticity and integrity of the downloaded files, providing additional security for users.

AC's

• The release workflow includes steps to generate and upload checksums.txt, checksums.txt.sig, and checksums.txt.pem.
• The checksums and signatures are verified during the release process.
• Documentation is updated to inform users about the availability and verification of checksums.