Normally I think "CRC" when someone uses the word checksum, so my initial question was "why is this not calling sha256sum?". Lo and behold, it just calls GitHub to get the hash.

That's fine, I guess. Nothing wrong with utility scripts. But I feel like "old man yelling at cloud" when I see a codebase with 178 stars, 527 commits, discord channels, and dozens of indirect dependencies for it.