Release artifact checksum validation

get_artifacts.sh

#!/bin/bash

set -ex

PRODUCT=${1}
VERSION=${2}

case "${PRODUCT}" in
  "k3s")
    REPO="k3s-io/k3s"
    ;;
  "rke2")
    REPO="rancher/rke2"
    ;;
  *)
    echo "invalid product '${PRODUCT}': must be one of k3s,rke2"
    exit 1
esac

if [ -z "${VERSION}" ]; then
  echo "missing version"
  exit 1
fi

mkdir -p "${VERSION}" && cd ${VERSION}

ASSETS="$(curl -fsH@<(set +x; echo "Authorization: Bearer ${GITHUB_TOKEN}") "https://api.github.com/repos/${REPO}/releases/tags/${VERSION}" | jq -rc '.assets[].browser_download_url')"
for ASSET in ${ASSETS}; do
  curl --progress-bar -LOC - "${ASSET}"
done

for CHECKSUM_FILE in sha256sum*; do
  sha256sum -c ${CHECKSUM_FILE}
done