Verify sha256 checksum in postinstall hook

[ericcrosson-bitgo]

Checksum added to GitHub release in #102

[ericcrosson-bitgo]

• remove the --binary flag passed to shasum in GitHub actions

[EricCrosson]

• embed the list of checksums in the npm package at publish time
• combine all the shasums into a single file

If we stay the course and use a process to run shasum in Node.js (to avoid a library to verify the sha256 checksum) consider environments that may not have the shasum command available. We could document a workaround to add your own shasum to the $PATH

[EricCrosson]

Hang on, sha256 is built into Node.js so we should examine re-hashing and comparing with the shasum value first

[EricCrosson]

const crypto = require('crypto');
const fs = require('fs');

const fileBuffer = fs.readFileSync('myfile.js');
const hashSum = crypto.createHash('sha256');
hashSum.update(fileBuffer);

const hex = hashSum.digest('hex');

console.log(hex);

source: https://ilikekillnerds.com/2020/04/how-to-get-the-hash-of-a-file-in-node-js/

is a match on my machine

[github-actions]

🎉 This issue has been resolved in version 3.1.7 🎉

The release is available on:

• v3.1.7
• npm package (@beta dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[EricCrosson]

Tested an install of 3.1.7 locally, examined the code and verified the checksum manually, all looks to be working as intended

[github-actions]

🎉 This issue has been resolved in version 4.0.0 🎉

The release is available on:

• v4.0.0
• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀