Verify downloads using checksums

[nodesocket]

Consul

SHA256 checksums for Consul 1.0.6
verify the checksums signature file
HashiCorp's GPG key

Nomad

SHA256 checksums for Nomad 0.7.1
verify the checksums signature file
HashiCorp's GPG key

Packer

SHA256 checksums for Packer 1.2.0
verify the checksums signature file
HashiCorp's GPG key

Terraform

SHA256 checksums for Terraform 0.11.3
verify the checksums signature file
HashiCorp's GPG key

Vault

SHA256 checksums for Vault 0.9.3
verify the checksums signature file
HashiCorp's GPG key

[westurner]

TUF (The Update Framework) specifies the right way to do this:
https://theupdateframework.github.io

Spec: https://github.com/theupdateframework/specification/blob/master/tuf-spec.md

Library: https://github.com/theupdateframework/tuf

Adopters have so far implemented the framework in the Go (1, 2), Haskell, Python, Ruby, and Rust programming languages.