When a component is installed from a stream, we should have a way to verify its integrity.

We could add a sha256checksum that would be verify when the corresponding artifact is downloaded to verify that its content has not been modified.
This is only possible if a fixed version is defined and would not make sense with versionPattern.

The checksum is also tied to the type and classifier of artifacts retrieved (eg Galleon pack would need to verify their zip package) while jar dependencies would verify their jar package. A single GA can define multiple artifacts thanks to the classifier, classifier, if any, is taken into account as [classifier/]extension in the key.

streams:
  - groupId: org.wildfly
    artifactId: wildfly-galleon-pack
    version: 26.0.0.Final
    sha256checksum:
      zip: d06591ac1fa5871258a574abcd4cc06f8be28ad1
  - groupId: org.wildfly.core
     artifactId: wildfly-controller
     version:19.0.0.Final
     sha256checksum:
       jar: 1cdc99e86a0002d111e7e41cc6989ca83624cd62
  - groupId: org.wildfly.core
     artifactId: wildfly-cli
     version:19.0.0.Final
     sha256checksum:
       jar: 1cdc99e86a0002d111e7e41cc6989ca83624cd62
       client/jar: 2adc99e86a0002d111e7e41cc6989ca83624cd98

• If the sha256checksum section is not present (or there is no value for the given package type), the integrity of the component will not be verified.
• If version is not present and the sha256checksum is present, an error will be reported.