Verified against archive.mozilla.org and the original builds
on my machine.

Keep a copy of the release tarball SHA-256 checksums in the
repository for reference. Having a copy with the code in
distributed version control adds a verification path.

This should match the opusfile checksums in
https://archive.mozilla.org/pub/opus/SHA256SUMS.txt and
http://downloads.xiph.org/releases/opus/SHA256SUMS.txt