fix: validate checksum of cached artifacts

[MarshallOfSound]

Fixes #210

[ckerr]

I'm not up-to-speed with all the differences between pre-1.3.2 and post-1.3.4, but the code here looks reasonable

[continuous-auth]

🎉 This PR is included in version 2.0.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[kanru]

The new behavior seems to be always trying to download the checksum file even if all other files are cached.
I'm unable to build electron apps in a sandboxed builder (without network) due to this.
Could you let me know if I need to cache everything where should I put the SHASUMS256.txt file?

[MarshallOfSound]

The new behavior seems to be always trying to download the checksum file even if all other files are cached.

This is the new correct/expected behavior.

Could you let me know if I need to cache everything where should I put the SHASUMS256.txt file?

Right next to the other files you were pre-filling the cache with

Worth noting that if you want to do this truly offline without prefilling the SHASUM file you could also provide a checksums object directly to @electron/get. This is for instance what the core electron npm package does --> https://github.com/electron/electron/blob/main/npm/install.js#L45