Provide release checksums, including WebAssembly

[v1rtl]

Hi,
Great project, big fan of Helios! Would be nice if releases included SHA-512 checksums, including WebAssembly, so it would be possible to verify if the binaries that are running are the same ones as the ones pulled from GitHub

[polymutex]

Echoing this request from the Walletbeat project. We use Helios as part of the continuous deployment pipeline. Currently we hardcode the expected sha512 hashes in the repository, along with a manual script to update them. A sort of poor man's lockfile. It would be nice to have some more canonical way to retrieve the latest hashes.

Perhaps these hashes should be stored onchain, and one could use Helios to verifiably fetch them there...

[ncitron]

Good idea! I'll look into this.

[karen-sarkisyan]

Hi @talentlessguy @polymutex ,
while not entirely what you suggest, on the next release helios will likely be published on NPM with a provenance statement. Do you think you could use it instead?

[v1rtl]

it's a good step to know that releases are built on a CI instead of a random person's computer, but it's not a checksum of the binary itself. I would want to verify the checksum against the one published somewhere on a reliable source (such as GitHub releases or a on-chain registry/mapping)