From 001d0a247d7986c212c208117c07a632a100fe82 Mon Sep 17 00:00:00 2001
From: Krasimir Kargov <krasikargov0703@gmail.com>
Date: Mon, 22 Jun 2026 15:46:41 +0300
Subject: [PATCH] Adding release checksums for our different builds

LMCROSSITXSADEPLOY-3520
---
 README.md | 21 +++++++++++++++++++++
 build.sh  | 11 +++++++++++
 2 files changed, 32 insertions(+)

diff --git a/README.md b/README.md
index 2dc5aba..e2d0a3f 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,27 @@ cf install-plugin <path-to-the-plugin> -f
 ```
 :rotating_light: Note: if you are running on an Unix-based system, you need to make the plugin executable before installing it. In order to achieve this, execute the following commad `chmod +x <path-to-the-plugin>`
 
+### Verifying the download
+Releases include a `checksums.txt` file containing SHA-256 hashes of every published binary. Verifying the checksum before installing detects accidental corruption and most forms of in-transit modification.
+
+Download `checksums.txt` from the same release as the binary and place both files in the same directory. Then run:
+
+Linux:
+```
+sha256sum -c checksums.txt --ignore-missing
+```
+
+macOS:
+```
+shasum -a 256 -c checksums.txt --ignore-missing
+```
+
+Windows (PowerShell):
+```
+#the checksums on Windows must be compared manually against the ones in checksums.txt
+Get-FileHash -Algorithm SHA256 multiapps-plugin.win64.exe
+```
+
 ## Usage
 The MultiApps CF plugin supports the following commands:
 
diff --git a/build.sh b/build.sh
index 0edf1fc..f06a647 100755
--- a/build.sh
+++ b/build.sh
@@ -49,6 +49,16 @@ function createBuildMetadataFiles() {
 	grep -Pzoa "(?s)## v${version}(.*?)##" CHANGELOG.md | grep -va "##" | tr -s '\n' '\n' > ${folder}/changelog
 }
 
+function createChecksumsForBinaries() {
+    local buildFolder=$1
+    echo "generating SHA-256 checksums..."
+    (
+        cd "${buildFolder}"
+        sha256sum multiapps-plugin.* multiapps-plugin-non-static.* > checksums.txt
+    )
+    echo "checksums were written to ${buildFolder}/checksums.txt"
+}
+
 script_dir="$(dirname -- "$(realpath -- "${BASH_SOURCE[0]}")")"
 cd "${script_dir}"
 
@@ -89,3 +99,4 @@ buildstatic "$version" darwin arm64 $PLUGIN_NAME_STATIC_APPLE_ARM64
 mkdir -p $BUILD_FOLDER
 createBuildMetadataFiles $version $BUILD_FOLDER
 movePluginsToBuildFolder $BUILD_FOLDER
+createChecksumsForBinaries $BUILD_FOLDER