Feature Request: Display SHA512 Hash of Precompiled Binaries in order to determine package integrity

[shashankbangalore]

Could the expected SHA512 hash of the archives of the precompiled Reapack binaries be listed on the repository to ensure package integrity? Thanks.

[cfillion]

In which scenario would this be useful? HTTPS (and TCP...) already checks integrity + authenticates the server. If the worry is the repository getting compromised, then any hashes on the repository would be equally untrustworthy as the binaries.

(If it's to check whether a local file claiming to be ReaPack is an official binary, then you can already do that by comparing against the real ones.)

Perhaps adding detached GPG signature files to the release assets would be a better way of proving not only integrity but also authenticity?

[shashankbangalore]

Yup, seems like the right call to provide some GPG signature files!