Validate checksum before consuming golang-with-libgit2 artefacts

[pjbgf]

The golang-with-libgit2 project has recently started providing signed releases for its artefacts.

The current logic needs to be updated to add said validation:

source-controller/hack/install-libraries.sh

Line 48 in 22c9e2e

curl -o output.tar.gz -LO "https://github.com/fluxcd/golang-with-libgit2/releases/download/${TAG}/darwin-libs.tar.gz"

[stefanprodan]

@pjbgf I see no signed release in here https://github.com/fluxcd/golang-with-libgit2/releases last one was in May.

[pjbgf]

@stefanprodan yep, there was an issue with the tag which I am working on atm. We should have a new release out at some point Today.