Add checksum to /release-metadata/releases-index.json

[dejees]

Would it be possible to add the checksum of the files mentioned in https://builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json? I'd like to guarantee that the files have not been tampered with.

[AustinWise]

I noticed that at the bottom of the index file and the release files there is a signature section that links to a .p7s file. This property is not documented and not exposed by the Microsoft.Deployment.DotNet.Releases Nuget package. This file appears to be a CMS/PKCS #7 detached signature. You can verify that the signature is valid using the System.Security.Cryptography.Pkcs Nuget package:

using System.Security.Cryptography.Pkcs;

var contentInfo = new ContentInfo(File.ReadAllBytes("releases.json"));
var signedCms = new SignedCms(contentInfo, detached: true);
signedCms.Decode(File.ReadAllBytes("releases.json.20260714180951.p7s"));
signedCms.CheckSignature(verifySignatureOnly: false); // throws if signature is bad

It would be nice if there was some official documentation about this file, but I could not find it.

[Labeeb2339]

There are already two integrity mechanisms here: artifact entries in releases.json include hashes, while the metadata also publishes a top-level signature object pointing to a timestamped detached .p7s CMS signature. A checksum is useful for change detection, but the detached signature additionally provides publisher authentication.

The documentation gap appears valid: the schema README describes the formats, but the current index schema does not document the top-level signature object. It would help to specify the signed bytes, .p7s naming, expiration semantics, certificate trust requirements, and a canonical verifier. SignedCms.CheckSignature(false) validates the signature and signer certificate; true verifies only the signature (Microsoft docs).