When distributing software binaries, you're making a promise about the file's integrity. Checksums are the mechanism to keep that promise. A checksum is a fixed-length value from a file's contents using a cryptographic hash like SHA256. If a single byte changes, the checksum changes completely, verifying the program is exactly what it claims to be.

Package managers generally handle this verification automatically, but binaries from GitHub releases or direct downloads lack that safety net. Without checksums, you risk downloading corrupted or tampered files. They confirm the file hasn't been altered, but they don't prove the author's identity or protect against a compromised server hosting both bad files and matching checksums.

Adding checksums to a release pipeline is straightforward. Generate artifacts, then create a checksums.txt file using a command like `shasum -a 256 * > checksums.txt`. Publish this file alongside your binaries. Users can then verify downloads by computing the local checksum and comparing it to the published value, ensuring their download is intact.