#!/usr/bin/env bash
# Emits the "Verifying the download" section appended to every release body
# by the "Upload assets to release" step of release.yaml.
# Keep this text in sync with the docs page:
#   docs.datacontroller.io/docs/downloads.md
set -euo pipefail
cat <<'EOF'

## Verifying the download

Every asset on this release is covered by the `SHA256SUMS` file. To verify a download, fetch `SHA256SUMS` from the release assets alongside the files you downloaded, then run:

```
sha256sum --check SHA256SUMS --ignore-missing
```

The command reports `OK` for each asset that matches. `--ignore-missing` lets you check just the files you downloaded rather than all of them.

What this protects: a matching checksum confirms the asset is byte-for-byte the file this pipeline uploaded, guarding against corrupted or tampered downloads (mirrors, proxies, interrupted transfers). It is not a signature: the hashes travel in the same release as the files, so a compromise of the forge itself could alter both. Treat it as an integrity check, not a trust anchor.
EOF