Download
Integrity Check
There are hashes (MD5, SHA1 and SHA256) of the download packages stored in the digests file. In order to check the integrity of the downloaded file, use a tool like md5sum (or sha1sum, sha256sum accordingly), e.g.:
$ md5sum -c cdbx-0.2.0.digests
cdbx-0.2.0.tar.bz2: OK
cdbx-0.2.0.tar.gz: OK
cdbx-0.2.0.tar.xz: OK
cdbx-0.2.0.zip: OK
In order to check the integrity of the digest file itself, you can check the PGP signature of that file. The file is signed by André Malo, Key-ID 0x8103A37E:
$ gpg --verify cdbx-0.2.0.digests
gpg: Signature made Sun Nov 21 20:53:48 2021 CET
gpg: using RSA key 21B65583FF640D34E8662B6B3DED446369F2EE1A
gpg: Good signature from "André Malo <nd@perlig.de>"