sarde-release-sign

Overview ¶

Command sarde-release-sign is the vendor-side release signing tool. It is deliberately a separate program, never built into the sarde binary, so the private key and signing code paths do not ship to users.

Generate a keypair (run once, keep the private key offline):

go run ./tools/sarde-release-sign -genkey -key release.key

The public key is printed as a Go literal to paste into internal/updatesign/pubkey.go.

Sign a release checksums file (GoReleaser runs this from its signs block):

go run ./tools/sarde-release-sign -in dist/checksums.txt -out dist/checksums.txt.sig

The private key may also be supplied via the SARDE_RELEASE_SIGNING_KEY environment variable (base64) instead of -key. The tool never prints key material on any code path.