From 9abfad29b901cf0c5285ff46604ad47a7fa64d0a Mon Sep 17 00:00:00 2001
From: svatantrya <svatantrya@bitcoin-after.life>
Date: Fri, 17 Jul 2026 09:51:37 -0400
Subject: [PATCH] feat(release): add signature, checksum and verification
 instructions

---
 docs/07_deployment_and_ops.md |  7 ++++
 make_release.sh               | 75 +++++++++++++++++++++++++----------
 2 files changed, 62 insertions(+), 20 deletions(-)

diff --git a/docs/07_deployment_and_ops.md b/docs/07_deployment_and_ops.md
index b32ea99..fda549b 100644
--- a/docs/07_deployment_and_ops.md
+++ b/docs/07_deployment_and_ops.md
@@ -133,6 +133,13 @@ This script builds a release binary, creates a Git tag, and uploads the release
 ```bash
 # WARNING: This script contains a hardcoded secret token. Do not use it as-is for production.
 ```
+- **Release Assets:** It generates a `.tar.gz` archive with the binaries, a `.sha256` checksum file, and a `.sig` GPG detached signature.
+- **Signature:** The release tarball is signed with the GPG key `Svātantrya <svatantrya@bitcoin-after.life>`. The script verifies that `gpg`, `sha256sum`, and `jq` are installed before proceeding.
+- **Verification:** The release body includes instructions for verifying the checksum and signature:
+  ```bash
+  sha256sum -c <release>.tar.gz.sha256
+  gpg --verify <release>.tar.gz.sig <release>.tar.gz
+  ```
 - **Security:** It also builds and uploads the binaries. The binaries should be built and signed on a separate, clean build machine, not on the production server.
 
 ### `download_bal_db.sh` (Database Pull Script)
diff --git a/make_release.sh b/make_release.sh
index 94ff9c6..f381e75 100644
--- a/make_release.sh
+++ b/make_release.sh
@@ -23,12 +23,23 @@ if [ -f .env ]; then
   export $(grep -v '^#' .env | xargs)
 fi
 
-TOKEN="${GITEA_API_TOKEN}"
+TOKEN="${GITEA_API_TOKEN:-${TOKEN_GITEA}}"
 if [ -z "$TOKEN" ]; then
-  echo_e "Error: GITEA_API_TOKEN is not set in .env file."
+  echo_e "Error: GITEA_API_TOKEN (or TOKEN_GITEA) is not set in .env file."
   echo_e "Please create a .env file with: GITEA_API_TOKEN=your_token_here"
   exit 1
 fi
+
+for cmd in gpg sha256sum jq; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo_e "Error: '$cmd' is required but not installed."
+    exit 1
+  fi
+done
+
+SIGNER_KEY="svatantrya@bitcoin-after.life"
+ASSET_SHA256="$ASSET_PATH.sha256"
+ASSET_SIG="$ASSET_PATH.sig"
 OWNER="bitcoinafterlife"
 basename=$(basename $(pwd))
 REPO=$basename
@@ -84,6 +95,13 @@ prepare_release(){
     ls "$(pwd)/$assetname"
     ls $assetname
     tar -czf "$asset_tar_gz" "$assetname"
+
+    sha256sum "$asset_tar_gz" > "$asset_tar_gz.sha256"
+
+    if ! gpg --batch --yes --detach-sign --local-user "$SIGNER_KEY" "$asset_tar_gz"; then
+      echo_e "error signing release tarball"
+      exit 1
+    fi
   )
 }
 
@@ -119,27 +137,44 @@ add_asset_release() {
     echo_e "error add_asset_release"
     exit 1
   fi
-  echo $ASSET_PATH
-  ls -l $ASSET_PATH
-  pwd
-  curl -X POST \
-    -H "accept: application/json" \
-    -H "Authorization: token $TOKEN" \
-    -H "Content-Type: multipart/form-data" \
-    -F "attachment=@$ASSET_PATH" \
-    "$url_releases/$1/assets"
+
+  local assets=("$ASSET_PATH" "$ASSET_SHA256" "$ASSET_SIG")
+  for asset in "${assets[@]}"; do
+    if [ ! -f "$asset" ]; then
+      echo_e "missing asset: $asset"
+      exit 1
+    fi
+    echo "Uploading: $asset"
+    ls -l "$asset"
+    curl -X POST \
+      -H "accept: application/json" \
+      -H "Authorization: token $TOKEN" \
+      -H "Content-Type: multipart/form-data" \
+      -F "attachment=@$asset" \
+      "$url_releases/$1/assets"
+  done
 }
 
-  # Estrae l'ID della release
-release_data=$(cat <<EOF
-{
-  "tag_name":"$TAG",
-  "name":"$release_name",
-  "body":"Release: $release_name enjoy\n$message"
-}
+release_body=$(printf '%s' "Release: $release_name enjoy
 
-EOF
-)
+$message
+
+---
+Verification Instructions:
+
+SHA256 Checksum:
+sha256sum -c $assetname.tar.gz.sha256
+
+GPG Signature:
+gpg --verify $assetname.tar.gz.sig $assetname.tar.gz
+
+Signed by Svātantrya (svatantrya@bitcoin-after.life)")
+
+release_data=$(jq -n -c \
+  --arg tag_name "$TAG" \
+  --arg name "$release_name" \
+  --arg body "$release_body" \
+  '{tag_name: $tag_name, name: $name, body: $body}')
 
 prepare_release
 echo_s "prepare release done"