Checksum for release artifacts

## Short Description

Please provide a checksum for the release artifacts.

## Possible Labels

- integrity
- new feature

## Select Category

- [ x ] Other

## **Describe the Update**

Provide a checksum of the release artifacts.

## **How This Feature will help you/your organization**

It allows one to confirm the integrity of the downloaded file. A simple checksum does not provide authenticity, but at least let's one verify the integrity.

## **Possible Solution/Implementation Details**

Use SHA-2 e.g. SHA256 and add the output of the Linux utility sha256sum as file.

~~~
sha256sum scancode-toolkit-30.1.0_py39-linux.tar.xz > scancode-toolkit-30.1.0_py39-linux.tar.xz.sha256sum
~~~

In release section:

* scancode-toolkit-30.1.0_py39-linux.tar.xz
* scancode-toolkit-30.1.0_py39-linux.tar.xz.sha256sum

## **Example & Links**

Both LinuxMint and Qubes OS provide checksums and signed checksums for their release artifacts (ISO files).

- [How to Verify a Linux ISO’s Checksum and Confirm It Hasn’t Been Tampered With](https://www.howtogeek.com/246332/how-to-verify-a-downloaded-linux-iso-file-wasnt-tampered-with/)](https://www.howtogeek.com/246332/how-to-verify-a-downloaded-linux-iso-file-wasnt-tampered-with/)
- [Linux Mint 20.3 "Una" - Download Cinnamon](https://linuxmint.com/edition.php?id=292)
- [Verifying signatures](https://www.qubes-os.org/security/verifying-signatures/)