feature: Please ship CHECKSUMS, ideally GPG-signed

[robbat2]

In the release process, please include CHECKSUMS of the distributed zipfiles.

Hash should be SHA256 or SHA512.

Optionally, but looks like it might be hard in your release process, the CHECKSUMS file should be GPG signed.

Example of JQ adding checksums - jqlang/jq#726

[jviotti]

I'm up for doing it. Let's do it in two steps:

• I'll upload the checksums first, unsigned. Should be pretty easy
• I'm quite familiar with GPG. I can create an identity for i.e. Sourcemeta, trust the specific deploy release GitHub Actions job with the private key, and have the public key announced somewhere (maybe at sourcemeta.com) and linked to from this project's README

I'm travelling this week, so not sure how much of it will happen until next week, but let's go for it! 💪🏻

Thanks for the suggestion as always

[jviotti]

Here is an initial PR for the unsigned checksums in case you have any early comments: #345

[jviotti]

The unsigned checksums have been published: https://github.com/sourcemeta/jsonschema/releases/tag/v9.3.3. I'll aim to sort out the GPG signing next week.

[jviotti]

I have a PR for the GPG signatures: #353. It all works locally, but we'll see if GitHub Actions likes it 😅