Publish checksums

[dfreilich]

Description

I would like to have proof that the pack releases on my system are the ones released by the Buildpacks organization.

Proposed solution

When releasing pack releases, we should publish checksums of the artifacts (sha256), and sign the artifacts as well (using PGP signing).

Describe alternatives you've considered

Additional context

• This feature should be documented somewhere

[dfreilich]

This has been an open issue in K8s (kubernetes/release#914) as well for a while, with a bunch of useful links posted. Some of the tools we may want to consider are:

• minisign (mentioned here)
• tuf (CNCF graduated) – Framework to secure software update systems

goreleaser seems like a really helpful tool to remove some of the complexity around releasing, but I'm not sure it's necessary for us

Initially, I'll work towards adding 2 new files per each release artifact:

1. pack-X.....sha256 (sha256 checksum)
2. pack-X.....asc (gpg signature)

[dfreilich]

The linked PR didn't include PGP signing.

[jromero]

@dfreilich can we create a new issue for that? I feel like it's not as critical given the added complexity.