The official release packages on `cmake.org` are currently offered by two hosts: * [`cmake.org/files/v*/cmake-*`](https://cmake.org/files) * [`github.com/Kitware/CMake/releases/download/v*/cmake-*`](https://github.com/Kitware/CMake/releases) The actual set of files available: names, architectures, formats, etc., can vary with the version of CMake. While a specific set of files may be used across a large range of CMake versions, this is not a stable API for finding files. Upstream must be able to change the set of files over time. #21972 identified cases in which tooling assumes that the set of files is a stable API in order to download a CMake binary given only a platform and CMake version number. Without any stable API, such tooling must memorize the names of files for each CMake version, and require updates for each CMake release. In order to help such tooling, we can add a single file with a stable name whose content lists the other files in a structured way. It should also reference the file containing the SHA-256 hashes, and the PGP signature file. That way clients can verify downloads by checking the hashes, and verify the hashes by checking the PGP signature against a known/stable public key.