feat(release): add ASCII-armored .asc signature alongside .sig

docs/07_deployment_and_ops.md

@@ -133,12 +133,13 @@ This script builds a release binary, creates a Git tag, and uploads the release
 ```bash
 # WARNING: This script contains a hardcoded secret token. Do not use it as-is for production.
 ```
-- **Release Assets:** It generates a `.tar.gz` archive with the binaries, a `.sha256` checksum file, and a `.sig` GPG detached signature.
+- **Release Assets:** It generates a `.tar.gz` archive with the binaries, a `.sha256` checksum file, and both a `.sig` GPG detached binary signature and a `.asc` ASCII-armored version.
 - **Signature:** The release tarball is signed with the GPG key `Svātantrya <svatantrya@bitcoin-after.life>`. The script verifies that `gpg`, `sha256sum`, and `jq` are installed before proceeding.
-- **Verification:** The release body includes instructions for verifying the checksum and signature:
+- **Verification:** The release body includes instructions for verifying the checksum and signature (binary or ASCII-armored):
   ```bash
   sha256sum -c <release>.tar.gz.sha256
   gpg --verify <release>.tar.gz.sig <release>.tar.gz
+  gpg --verify <release>.tar.gz.asc <release>.tar.gz
   ```
 - **Security:** It also builds and uploads the binaries. The binaries should be built and signed on a separate, clean build machine, not on the production server.
 

make_release.sh

@@ -56,6 +56,7 @@ ASSET_PATH="$destbin/$assetname.tar.gz"
 SIGNER_KEY="svatantrya@bitcoin-after.life"
 ASSET_SHA256="$ASSET_PATH.sha256"
 ASSET_SIG="$ASSET_PATH.sig"
+ASSET_ASC="$ASSET_PATH.asc"
 
 giteahost="https://bitcoin-after.life/gitea"
 url_releases="$giteahost/api/v1/repos/$OWNER/$REPO/releases"
@@ -100,7 +101,12 @@ prepare_release(){
     sha256sum "$asset_tar_gz" > "$asset_tar_gz.sha256"
 
     if ! gpg --batch --yes --detach-sign --local-user "$SIGNER_KEY" "$asset_tar_gz"; then
-      echo_e "error signing release tarball"
+      echo_e "error signing release tarball (binary)"
+      exit 1
+    fi
+
+    if ! gpg --batch --yes --detach-sign --armor --output "$asset_tar_gz.asc" --local-user "$SIGNER_KEY" "$asset_tar_gz"; then
+      echo_e "error signing release tarball (ascii-armored)"
       exit 1
     fi
   )
@@ -139,7 +145,7 @@ add_asset_release() {
     exit 1
   fi
 
-  local assets=("$ASSET_PATH" "$ASSET_SHA256" "$ASSET_SIG")
+  local assets=("$ASSET_PATH" "$ASSET_SHA256" "$ASSET_SIG" "$ASSET_ASC")
   for asset in "${assets[@]}"; do
     if [ ! -f "$asset" ]; then
       echo_e "missing asset: $asset"
@@ -166,9 +172,12 @@ Verification Instructions:
 SHA256 Checksum:
 sha256sum -c $assetname.tar.gz.sha256
 
-GPG Signature:
+GPG Signature (binary):
 gpg --verify $assetname.tar.gz.sig $assetname.tar.gz
 
+GPG Signature (ASCII-armored):
+gpg --verify $assetname.tar.gz.asc $assetname.tar.gz
+
 Signed by Svātantrya (svatantrya@bitcoin-after.life)")
 
 release_data=$(jq -n -c \