Revise the signature verification section the Zowe Downloads area at zowe.org

[RASakach]

Revise as follows:

• Ensure all appropriate downloads have a Signature Verification section
• Leverage examples to obtain appropriate verbiage such as: the Open SSF documentation; IBM similar documentation here https://www.ibm.com/support/pages/how-verify-integrity-download-resource OR Linux distribution
• The current verbiage is located here: https://www.zowe.org/post_download.html?version=2.8.0

Goals:

1. Consistency across the various download choices
2. Include recommendations: When and How to perform the verification process, describe "troublesome" outputs and WHAT to do if the verification fails
3. Note and request changes to the SUPPORT PROVIDER CONFORMANCE program to ensure this verification is mentoned.

[jp669844]

Where is the post-download page shown currently:

• Convenience build - YES
• SMP/E build - NO
• Zowe Portable Software Instance - NO
• Containerization build - NO
• Zowe CLI - NO
• Zowe Client SDKs - NO
• Zowe Explorer - N/A

However, all artifacts files .sha512 and .asc are available, just not directly downloadable (from the Zowe pages). The thing is that for most other downloads there is a documentation page shown, instead of the post-download. The page itself is universal and parametrized enough to allow its presence everywhere needed.

Another example of the verify page: https://downloads.apache.org/httpd/

[RASakach]

Onboarding Meeting Update:

• we agreed to add a box/button on the download page next to each download that has a Signature Verification
• this new box/button will take the user to an updated Signature Verification Page
• the button will read something like "signature verification instructions"

@jp669844: @adam-wolfe also had a suggestion, please review this pull request: zowe/zowe.github.io#849

[balhar-jakub]

I approved the PR, do we need anything else before merging it?

[jp669844]

You can merge Adam's PR. There will be a new PR covering changes from this issue.

[RASakach]

We now have the ability to verify Zowe CLI, Zowe CLI plug-ins, and Zowe SDKs.

Further work on signature verification will require a new issue.