Update manifest

[taiki-e]

Auto-generated by create-pull-request

[NobodyXu]

@taiki-e Just to let you know, we at cargo-binstall are now working on:

• Initial pre-built binaries signing support Initial signing support cargo-bins/cargo-binstall#1345
• Signing pre-built binaries of cargo-binstall, our signing key would be unique for each release to minimize the risk of leaking private key Sign our releases cargo-bins/cargo-binstall#1347

[taiki-e]

Great!

Signing pre-built binaries of cargo-binstall,

Which files will be signed? In any case, I think we can support that on the codegen side ¹, but it would probably be easiest if it is a checksum file or an archive.

Footnotes

1. We can extend the codegen to ensure that the hash in the generated manifest is the same as that obtained from the signed archive or indicated in the signed checksum file. This allows signature verification to be performed without additional cost at the time of execution of the action. ↩

[NobodyXu]

All pre-built binaries (tarballs) in cargo-binstall release will be signed.