Add checksum to /release-metadata/releases-index.json

[dejees]

Would it be possible to add the checksum of the files mentioned in https://builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json? I'd like to guarantee that the files have not been tampered with.

[AustinWise]

I noticed that at the bottom of the index file and the release files there is a signature section that links to a .p7s file. This property is not documented and not exposed by the Microsoft.Deployment.DotNet.Releases Nuget package. This file appears to be a CMS/PKCS #7 detached signature. You can verify that the signature is valid using the System.Security.Cryptography.Pkcs Nuget package:

using System.Security.Cryptography.Pkcs;

var contentInfo = new ContentInfo(File.ReadAllBytes("releases.json"));
var signedCms = new SignedCms(contentInfo, detached: true);
signedCms.Decode(File.ReadAllBytes("releases.json.20260714180951.p7s"));
signedCms.CheckSignature(verifySignatureOnly: false); // throws if signature is bad

It would be nice if there was some official documentation about this file, but I could not find it.