[Documentation request]: Have all releases have an associated SHA256_sums.md file

[AJRepo]

To which page is your issue related?

No response

Describe your documentation request!

In order to ensure that files are not corrupted between compilation and downloading there's usually a sha256sum file that many software companies release at the same time as the binaries. It lists all the files in the release and their SHA256 sum. If there is on on the releases page I could not find it. Can you create and add one?

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[CodeDoctorDE]

Hi, thanks for noting this.
Is there no system to get it by the github api?
Otherwise I could add it. How does it other projects do?
A .md may not be suited for everyone? I think adding a checksum for each file could be better here?
for example linwood-butterfly-windows.zip.sha256sum

[AJRepo]

I found no way to get it from github. Docs points to https://butterfly.linwood.dev/docs/2.2/intro which gives a 404 error

A .sha256sum file would be great as a per-file or for all files.

Here's an example for Conda: https://docs.conda.io/projects/conda/en/latest/user-guide/install/index.html

here's an example of a SHA256SUM file for all releases in source: https://github.com/AJRepo/pietimer_kivy/blob/main/SHA256SUMS

[CodeDoctorDE]

docs link is fixed.

But what are the idea of sha256sum files then? You could manipulate both of them to your linking?
But how does this one file for all files work then? Could you easily verify them with this file?

[AJRepo]

Thanks for fixing the link!

The SHA256SUM file has a format of

hash1     filename1
hash2     filename2
...

Example: if you have a sha256sum file named ButterFlyReleases.sha256sum then if one is in the directory where these files are and you want to test all of them then one can run

sha256sum -c ButterFlyReleases.sha256sum and it would generate a report like

filename1: OK
filename2: OK

If however you were only interested in filename1, then you'd run something like

grep filename1 ButterFlyReleases.sha256sum | sha256sum -c

and get as a response

filename1: OK

The reason people use sha256sum files with releases is for a few reasons. Some reasons include (1) Checking a download , (2) checking that there's no corruption on moving to/from USB (had that happen with a bad USB stick), and most importantly (3) that there's no change from the compiling step to the web-release step.

More on (3). The hash file is " 'marking' this at the time of compiling." With that 'mark' it completely removes numerous attack vectors and makes it harder for someone to corrupt or inject code into a release. Assuming that the machine compiling the code is not compromised, then all the attacks on only binary files fail and attacks that modify both 256sum files and binaries are very easy to spot.

[CodeDoctorDE]

Thanks for the explaination.
I will add it in the next release