Currently, there are no checksums associated with a platform's release tarball so that installers can validate them, eg. scoop.

Usually, this is done with something like ${project}_${version}_checksums.txt, but this might be annoying for sccache because it isn't cross-compiled, so maybe just doing a simple ${tarball_name}.sha/256 would allow easy validation without complicating the release process too much.

https://github.com/gohugoio/hugo/releases is a good example.