The packages are created, check-summed and automatically uploaded from the code in this repository by Github Actions to Github Releases and CloudSmith.

The GPG key used to sign the packages can be found here.