Name the package manifest to something less general than SHA256SUMS ?

[afbjorklund]

It would be nice if the filename didn't dictate the digest, for better future compatibility.

It would also be nice if it didn't have the same name as all other generated lists of files.

Maybe even JSON, like jsonlines format ?

But something more like multiformats.

[afbjorklund]

Back in the day, we even had package checksums to verify the payload and not just the wrapper archive.

That way you could still verify your installation, even after installation - or with new compression formats.
This checksum was of course signed, so that you could verify the signature that created the binaries...

I think it is still there in the RPM format, for instance ? Or in external formats, like the 0install XML.

• https://docs.0install.net/specifications/manifest/