feat(release): add signature, checksum and verification instructions

make_release.sh

@@ -23,12 +23,23 @@ if [ -f .env ]; then
   export $(grep -v '^#' .env | xargs)
 fi
 
-TOKEN="${GITEA_API_TOKEN}"
+TOKEN="${GITEA_API_TOKEN:-${TOKEN_GITEA}}"
 if [ -z "$TOKEN" ]; then
-  echo_e "Error: GITEA_API_TOKEN is not set in .env file."
+  echo_e "Error: GITEA_API_TOKEN (or TOKEN_GITEA) is not set in .env file."
   echo_e "Please create a .env file with: GITEA_API_TOKEN=your_token_here"
   exit 1
 fi
+
+for cmd in gpg sha256sum jq; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo_e "Error: '$cmd' is required but not installed."
+    exit 1
+  fi
+done
+
+SIGNER_KEY="svatantrya@bitcoin-after.life"
+ASSET_SHA256="$ASSET_PATH.sha256"
+ASSET_SIG="$ASSET_PATH.sig"
 OWNER="bitcoinafterlife"
 basename=$(basename $(pwd))
 REPO=$basename
@@ -84,6 +95,13 @@ prepare_release(){
     ls "$(pwd)/$assetname"
     ls $assetname
     tar -czf "$asset_tar_gz" "$assetname"
+
+    sha256sum "$asset_tar_gz" > "$asset_tar_gz.sha256"
+
+    if ! gpg --batch --yes --detach-sign --local-user "$SIGNER_KEY" "$asset_tar_gz"; then
+      echo_e "error signing release tarball"
+      exit 1
+    fi
   )
 }
 
@@ -119,27 +137,44 @@ add_asset_release() {
     echo_e "error add_asset_release"
     exit 1
   fi
-  echo $ASSET_PATH
-  ls -l $ASSET_PATH
-  pwd
-  curl -X POST \
-    -H "accept: application/json" \
-    -H "Authorization: token $TOKEN" \
-    -H "Content-Type: multipart/form-data" \
-    -F "attachment=@$ASSET_PATH" \
-    "$url_releases/$1/assets"
+
+  local assets=("$ASSET_PATH" "$ASSET_SHA256" "$ASSET_SIG")
+  for asset in "${assets[@]}"; do
+    if [ ! -f "$asset" ]; then
+      echo_e "missing asset: $asset"
+      exit 1
+    fi
+    echo "Uploading: $asset"
+    ls -l "$asset"
+    curl -X POST \
+      -H "accept: application/json" \
+      -H "Authorization: token $TOKEN" \
+      -H "Content-Type: multipart/form-data" \
+      -F "attachment=@$asset" \
+      "$url_releases/$1/assets"
+  done
 }
 
-  # Estrae l'ID della release
-release_data=$(cat <<EOF
-{
-  "tag_name":"$TAG",
-  "name":"$release_name",
-  "body":"Release: $release_name enjoy\n$message"
-}
+release_body=$(printf '%s' "Release: $release_name enjoy
 
-EOF
-)
+$message
+
+---
+Verification Instructions:
+
+SHA256 Checksum:
+sha256sum -c $assetname.tar.gz.sha256
+
+GPG Signature:
+gpg --verify $assetname.tar.gz.sig $assetname.tar.gz
+
+Signed by Svātantrya (svatantrya@bitcoin-after.life)")
+
+release_data=$(jq -n -c \
+  --arg tag_name "$TAG" \
+  --arg name "$release_name" \
+  --arg body "$release_body" \
+  '{tag_name: $tag_name, name: $name, body: $body}')
 
 prepare_release
 echo_s "prepare release done"