Assume your skel requires requires a downloadable tarball. Let it be
GNU Parallel for example. We want to place it in build/distfiles/dl
directory. It contains default.do file, which will search for
corresponding .meta4 file in build/distfiles/meta directory and will run
one of [Build/Distfiles/Fetchers] to retrieve and verify the tarball.

According to parallel's homepage, it is advised to use GNU mirrors for
downloading, so let's take its latest release with the signature:

    $ fetch http://ftpmirror.gnu.org/parallel/parallel-20240122.tar.bz2
    $ fetch http://ftpmirror.gnu.org/parallel/parallel-20240122.tar.bz2.sig

Verify the signature.

Metalink4 files are currently automatically created from pieces of
metainformation. Although you are not forced to use that automation, but
it is pretty convenient and easy to use.

Create $DISTFILES/meta/parallel-20240122.tar.bz2 directory.
Store tarball's size in it:

    $ tarball=parallel-20240122.tar.bz2
    $ mkdir $DISTFILES/meta/$tarball $DISTFILES/meta/$tarball.sig
    $ stat -f %z $tarball >$DISTFILES/meta/$tarball/size
    $ stat -f %z $tarball.sig >$DISTFILES/meta/$tarball.sig/size

Compute its checksum. There is no preferred algorithm. One could be
satisfied with non-cryptographic, but very fast XXH3. Somebody want
to use fast cryptographic BLAKE3 or BLAKE2. Somebody likes Skein.
Somebody requires GOST Streebog ones. Maybe there are people preferring
slow SHA2 family of algorithms. Let's precompute a bunch of them. We
will use hashes-gen script:

    $ $BASS_ROOT/build/bin/hashes-gen <$tarball >$DISTFILES/meta/$tarball/hashes

Or we can use helper script doing completely the same:

    $ cd $DISTFILES/meta
    $ ../bin/metadir-from-file /path/to/$tarball
    $ ../bin/metadir-from-file /path/to/$tarball.sig

Then we must store a list of URLs where it can be fetched. That may be
just trivial:

    $ echo http://.../$tarball.sig >$DISTFILES/meta/$tarball.sig/urls

But many software is hosted on mirrored websites. It is highly advisable
to specify not only the entrypoints (like ftpmirror.gnu.org), but all
possible endpoint mirrors, because load balancer is a single point of
failure. Read about that in [Build/Distfiles/Mirrors].

There are several helpers to ease generation of some mirrors lists.
Fortunately there is one for GNU ecosystem. You should automatically
generate your urls file instead then.

    $ cat >$DISTFILES/meta/$tarball/urls.do <<EOF
    redo-ifchange ../../lib/urls-for-gnu
    ../../lib/urls-for-gnu parallel/$(basename $(pwd))
    EOF
    $ git add $DISTFILES/meta/$tarball*

That is all! You may "redo $DISTFILES/meta/$tarball.meta4" to get the
generated Metalink4 file based on metainformation you supplied.
"redo $DISTFILES/dl/$tarball" should use it for downloading and
verifying.

It is also advisable to provide cryptographic signature themselves, not
lone download links. Let's place them into [Build/Distfiles/Cache]:

    $ mv $tarball.sig $DISTFILES/dl/cache
    $ git add --force $DISTFILES/dl/cache/$tarball.sig