From 66dbaa6659cdea935396d7859cd19f07b0a77359 Mon Sep 17 00:00:00 2001
From: Casey Rodarmor <casey@rodarmor.com>
Date: Tue, 8 Oct 2024 12:19:37 -0700
Subject: [PATCH] Document checking releases hashes  (#2418)

---
 .github/workflows/release.yaml |  2 +-
 README.md                      | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 525eea999f..128c835001 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -137,8 +137,8 @@ jobs:
     runs-on: ubuntu-latest
 
     needs:
-    - prerelease
     - package
+    - prerelease
 
     steps:
     - name: Download Release Archives
diff --git a/README.md b/README.md
index d7e6339ed0..535b2bc402 100644
--- a/README.md
+++ b/README.md
@@ -381,6 +381,16 @@ to determine the latest version of `just` to install, and those API calls are
 rate-limited on a per-IP basis. To make `install.sh` more reliable in such
 circumstances, pass a specific tag to install with `--tag`.
 
+[Releases](https://github.com/casey/just/releases) include a `SHA256SUM` file
+which can be used to verify the integrity of pre-built binary archives.
+
+To verify a release, download the pre-built binary archive along with the
+`SHA256SUM` file and run:
+
+```sh
+shasum --algorithm 256 --ignore-missing --check SHA256SUMS
+```
+
 ### GitHub Actions
 
 `just` can be installed on GitHub Actions in a few ways.