Preferably, these release artifacts are generated by a pipeline, and the hashes are verifiable.