sign-release

Overview ¶

sign-release signs a SHA256SUMS file with the release Ed25519 private key.

Usage (typically inside the release workflow):

GHOSTPSY_RELEASE_SIGNING_KEY_HEX=<hex> go run ./scripts/sign-release path/to/SHA256SUMS

Writes “path/to/SHA256SUMS.sig“ containing the hex-encoded Ed25519 signature over the file content. The agent verifies this with the matching public key embedded in the binary.

Exits non-zero if the env var is missing, the key is malformed, the input file cannot be read, or the output file cannot be written.