Use immutable releases

[fleimgruber]

As a developer packaging alire for scoop in ScoopInstaller/Main#7382 I need a file containing the checksums of release artifacts to be able to auto-upgrade the package.

For reference in golang, this file can be generated using goreleaser, as done here. Maybe there is equivalent Ada tooling?

There is also github action for this.

[Lutra-Fs]

As a maintainer of Scoop, I'd like to clarify that Scoop can retrieve file hashes for GitHub release artifacts directly - so a separate checksum file is not strictly required for basic auto-updates. You can simply omit the hash value in the autoupdate field, and Scoop will handle hash retrieval automatically during updates using the GitHub API.
However, providing an official checksum file or using immutable release is still helpful to improve the supply chain transparency and the safety of the software.

[fleimgruber]

Thanks for the clarification, I made the change you suggested in the packaging PR.

Resolved for me, close or keep open as reminder.

[mosteo]

I'll look into immutable releases, thanks for bringing this up.