[PATCH] Update release script to generate detached signatures and checksum files

[Eli Schwartz]

This is more usable for programmatically checking the validity of a
release.
---

So this is what I'm envisioning. This generates the following files:

busybox-$VERSION.tar.gz
busybox-$VERSION.tar.gz.sig
busybox-$VERSION.tar.gz.sha256

And the same for tar.bz2

Users or distro maintainers can download either  the .sig file or the
.sha256 to the same directory as the release archive, and then verify
the archive by running,

for gpg:
gpg --verify busybox-$VERSION.tar.gz.sig

for simply checking the checksums:
sha256sum -c busybox-$VERSION.tar.gz.sha256

I do not anticipate anyone wishing to check both. gpg signatures fulfill
the role of checksums, because if the signature verification succeeds,
then they already know the file did not get downloaded in a malformed
fashion. 

 scripts/bb_release | 22 +++++-----------------
 1 file changed, 5 insertions(+), 17 deletions(-)

diff --git a/scripts/bb_release b/scripts/bb_release
index 8aa380438..2e146bf84 100755
--- a/scripts/bb_release
+++ b/scripts/bb_release
@@ -15,20 +15,8 @@ VERSION=`ls busybox-*.tar.gz | sed 's/busybox-\(.*\)\.tar\.gz/\1/'`
 
 zcat busybox-$VERSION.tar.gz | bzip2 > busybox-$VERSION.tar.bz2
 
-test -f busybox-$VERSION.tar.gz || { echo "no busybox-$VERSION.tar.gz"; exit 1; }
-test -f busybox-$VERSION.tar.bz2 || { echo "no busybox-$VERSION.tar.bz2"; exit 1; }
-
-signit()
-{
-echo "$1 released `date -r $1 -R`
-
-MD5:  `md5sum $1`
-SHA1: `sha1sum $1`
-
-To verify this signature, you can obtain my public key
-from http://busybox.net/~vda/vda_pubkey.gpg
-" | gpg --clearsign > "$1.sign"
-}
-
-signit busybox-$VERSION.tar.gz
-signit busybox-$VERSION.tar.bz2
+for releasefile in busybox-$VERSION.tar.gz busybox-$VERSION.tar.bz2; do
+    test -f $releasefile || { echo "no $releasefile"; exit 1; }
+    gpg --detach-sign $releasefile
+    sha256sum $releasefile > $releasefile.sha256
+done
-- 
2.17.1