sha256sums for kind binaries

[cokegen]

What would you like to be added: sha256sums / gpg signatures for kind binaries

Why is this needed: some basic form of verification at least for the kind binaries would be good to have, hashes, gpg signatures, etc.

[BenTheElder]

We can and should definitely add shasums to the binaries so download integrity can be checked.

I don't think the Kubernetes project currently has a solution for signing, if/when it does we'll follow suit here.

kind binary builds should be reproducible at least though, so anyone can vet that the binary + sha reflects the sources fairly easily (clone the sources, run the build and compare, they should match, if not that's a regression we should fix).

---

This should make a pretty good starter issue for anyone interested, basically update this script which we run as part of the release process to produce a ${file_name}.sha256sum file containing the hash of ${file_name} for each build output file after we build:

https://github.com/kubernetes-sigs/kind/blob/c64d7644516f7214c063b4cee5c324fd14e6dd1e/hack/release/build/cross.sh

Then when we release these will be alongside the binary outputs and we'll upload them as well

/help
/good-first-issue
/sig testing

[k8s-ci-robot]

@BenTheElder:
This request has been marked as suitable for new contributors.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-good-first-issue command.

In response to this:

We can and should definitely add shasums to the binaries so download integrity can be checked.

I don't think the Kubernetes project currently has a solution for signing, if/when it does we'll follow suit here.

kind binary builds should be reproducible at least though, so anyone can vet that the binary + sha reflects the sources fairly easily.

---

This should make a pretty good starter issue for anyone interested, basically update this script which we run as part of the release process to produce a ${file_name}.sha256sum file containing the hash of ${file_name} for each build output file after we build:

https://github.com/kubernetes-sigs/kind/blob/c64d7644516f7214c063b4cee5c324fd14e6dd1e/hack/release/build/cross.sh

Then when we release these will be alongside the binary outputs and we'll upload them as well

/help
/good-first-issue
/sig testing

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[viveksyngh]

/assign

[asher-lab]

hello @viveksyngh is there a readme or some place where the sha256sum/sha512sum are published? like from kubernetes where the sha512 sum are in there readme file? https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md thanks

[BenTheElder]

They're alongside the release binaries. See "assets" at the bottom of e.g. https://github.com/kubernetes-sigs/kind/releases/tag/v0.20.0, which is standard for github hosted releases.