Changes the release manifest format to more closely match the releases API V1 (example https://api.releases.hashicorp.com/v1/releases/terraform-cloudplugin/0.1.0-prototype)
- The new format doesn't carry the SHASUM for each build, so it made the matching_sums check in releaseauth redundant.
- Added tests for checksum parsing
- Added ID-based selection of signature file
Package releaseauth helps authenticates archives downloaded from a service like releases.hashicorp.com by providing some simple authentication tools:
1. Matching reported SHA-256 hash against a standard SHA256SUMS file.
2. Calculates the SHA-256 checksum of an archive and compares it against a reported hash.
3. Ensures the checksums were signed by HashiCorp.
