Adding release checksums for our different builds

README.md

@@ -40,6 +40,27 @@ cf install-plugin <path-to-the-plugin> -f
 ```
 :rotating_light: Note: if you are running on an Unix-based system, you need to make the plugin executable before installing it. In order to achieve this, execute the following commad `chmod +x <path-to-the-plugin>`
 
+### Verifying the download
+Releases include a `checksums.txt` file containing SHA-256 hashes of every published binary. Verifying the checksum before installing detects accidental corruption and most forms of in-transit modification.
+
+Download `checksums.txt` from the same release as the binary and place both files in the same directory. Then run:
+
+Linux:
+```
+sha256sum -c checksums.txt --ignore-missing
+```
+
+macOS:
+```
+shasum -a 256 -c checksums.txt --ignore-missing
+```
+
+Windows (PowerShell):
+```
+#the checksums on Windows must be compared manually against the ones in checksums.txt
+Get-FileHash -Algorithm SHA256 multiapps-plugin.win64.exe
+```
+
 ## Usage
 The MultiApps CF plugin supports the following commands:
 

build.sh

@@ -49,6 +49,16 @@ function createBuildMetadataFiles() {
 	grep -Pzoa "(?s)## v${version}(.*?)##" CHANGELOG.md | grep -va "##" | tr -s '\n' '\n' > ${folder}/changelog
 }
 
+function createChecksumsForBinaries() {
+    local buildFolder=$1
+    echo "generating SHA-256 checksums..."
+    (
+        cd "${buildFolder}"
+        sha256sum multiapps-plugin.* multiapps-plugin-non-static.* > checksums.txt
+    )
+    echo "checksums were written to ${buildFolder}/checksums.txt"
+}
+
 script_dir="$(dirname -- "$(realpath -- "${BASH_SOURCE[0]}")")"
 cd "${script_dir}"
 
@@ -89,3 +99,4 @@ buildstatic "$version" darwin arm64 $PLUGIN_NAME_STATIC_APPLE_ARM64
 mkdir -p $BUILD_FOLDER
 createBuildMetadataFiles $version $BUILD_FOLDER
 movePluginsToBuildFolder $BUILD_FOLDER
+createChecksumsForBinaries $BUILD_FOLDER