Verify the checksum of the installer

[lazka]

Would be nice to have because you never know :)

There is an issue for downloadTool() already here, but no progress: actions/toolkit#427

[eine]

I found two commands to compute the checksum on Windows:

• CertUtil -hashfile FILE SHA256
• Get-FileHash FILE -Algorithm SHA256 | Format-List -Property Hash

The output of the second one seems easier to parse and compare.

However, are checksums of the assets available anywhere apart from https://www.msys2.org/#installation-prerequisites?

[lazka]

However, are checksums of the assets available anywhere apart from https://www.msys2.org/#installation-prerequisites?

It doesn't really matter where you get them from (you can also use sha256sum locally), just hardcode them when you change the installer URL so everybody gets the same and the installer can't change unnoticed

[eine]

I added a basic check (05abb8d) in the latest release. Thanks to @Paebbels for the help with powershell syntax ;)

However, I'll leave this issue open because I want to enhance the code.

[lazka]

Thanks!