ether-release-sign

Overview ¶

Command ether-release-sign manages Ether's release-signing keys and signs update manifests. It is a CI/maintainer tool; it is not shipped in installers.

Usage:

ether-release-sign keygen [-out key.txt]
    Generate an ed25519 key pair. Prints (or writes) the private key
    (keep secret; CI: ETHER_UPDATE_PRIVATE_KEY) and the public key
    (bake into releases via -ldflags -X updater.PublicKeyB64=...).

ether-release-sign sign -key <b64|file> -in manifest.json [-out signed.json] [-detached]
    Sign a manifest. Default embeds the signature; -detached writes
    <out>.sig instead and leaves the manifest bytes untouched.
    The key may also come from $ETHER_UPDATE_PRIVATE_KEY.

ether-release-sign verify -pub <b64> -in manifest.json [-sig manifest.json.sig]
    Verify an embedded or detached signature.

ether-release-sign manifest -version 1.2.0 -channel stable -artifact file:os:arch:kind:url [-artifact ...] [-notes URL] [-out manifest.json]
    Build an unsigned manifest from local artifact files (hashes and
    sizes are computed here, so CI cannot publish a wrong checksum).