ci: sign releases and add verification instructions (#192)

Author: jackstar12

.github/workflows/release.yml

@@ -36,5 +36,43 @@ jobs:
       - name: Release
         uses: softprops/action-gh-release@v2
         with:
-          files: bin/*.zip
+          files: |
+            boltz-client-*.tar.gz
+            boltz-client-manifest-*.txt
           draft: true
+          body: |
+            # Verifying the Release
+
+            In order to verify the release, you'll need to have `gpg` or `gpg2` installed on your system. You'll first need to import the keys that have signed this release if you haven't done so already: 
+
+            ```
+            curl https://raw.githubusercontent.com/BoltzExchange/boltz-client/master/keys/michael.asc | gpg --import
+            ```
+
+            Once you have the required PGP keys, you can verify the release (assuming `boltz-client-manifest-${{ env.RELEASE_VERSION }}.sig` and `boltz-client-manifest-${{ env.RELEASE_VERSION }}.txt` are in the current directory) with:
+
+            ```
+            gpg --verify boltz-client-manifest-${{ env.RELEASE_VERSION }}.sig boltz-client-manifest-${{ env.RELEASE_VERSION }}.txt
+            ```
+
+            You should see the following if the verification was successful:
+
+            ```
+            gpg: Signature made Mo 01 Jul 2024 00:40:51 CEST
+            gpg:                using RSA key C2640F630570F5EDEDE02DE684D249BA71685D46
+            gpg: Good signature from "Michael <me@michael1011.at>" [unknown]
+            gpg:                 aka "Michael <michael101101@me.com>" [unknown]
+            ```
+            
+            You should also verify that the hashes still match with the archive you've downloaded.
+            
+            ```
+            sha256sum --ignore-missing -c boltz-client-manifest-${{ env.RELEASE_VERSION }}.txt
+            ```
+            
+            If your archive is valid, you should see the following output (depending on the archive you've downloaded):
+            
+            ```
+            boltz-client-linux-amd64-${{ env.RELEASE_VERSION }}.tar.gz: OK
+            ```
+

Makefile

@@ -125,7 +125,8 @@ docker:
 binaries:
 	@$(call print, "Building binaries")
 	docker buildx build --output bin --platform $(PLATFORMS) --target binaries .
-	tar -czvf bin/boltz-client-linux-amd64.tar.gz bin/linux_amd64
-	tar -czvf bin/boltz-client-linux-arm64.tar.gz bin/linux_arm64
+	tar -czvf boltz-client-linux-amd64-v$(VERSION).tar.gz bin/linux_amd64
+	tar -czvf boltz-client-linux-arm64-v$(VERSION).tar.gz bin/linux_arm64
+	sha256sum boltz-client-*.tar.gz bin/**/* > boltz-client-manifest-v$(VERSION).txt
 
 .PHONY: build binaries

keys/michael.asc

@@ -0,0 +1,90 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFqdS8wBEAC5QzhAhXb0yeDLKrH8XLtSIxsc3f/ydC29uxQKowhVL1hrgCQO
+fNAhms3l5l13wqLav4eEeKhte8Fqd7kBk5Aw0dGsuEsMhpCCkh1hu7AY17xouzYH
+hoUf5EsFrEilpqoNHAcShDahnXYqZtIn8n8IVX/C9ihpQu56AsuLtKfWcohoP4+c
+/fcSryiDQtF/gy6QigfLA0YkViK34hDctmNpsnLN3Xw/2VHCcxx+QJ1f636FIH8C
+9/Jkzc2VsI+ju3i4PtW/LpPNbkdxr4NCuqiPjBC+5zckq3bU0ZQHn6jMOpasNGzs
+t8JQmDteHSaPpwqdroZS/t9kACh83LLFj1aUn+A7kX/vKu3ZSOFO/P/Y7j1VYeAb
+mYToeYeI63Rp4wM/dUKlp3p+c1QxdDPYFsaHHCTB/4WwvKOdtE8vZQUug8pPcc/b
+6xTIMn/El3GIaGYZpQbQZ+3rV8EwYkDoOU5vG8pQyvNlOqcBbSQkVE927UNpRFpM
+0VTxwtlaFTVSB9jjsNQobHuc1CjW0aPG0hwgVQc4V6FYq6URDkduNc57xeKiWYn/
+7tvcTVvOdSUJvKHTMmI4xJmQYiBjzi3+CGWVr+AcDbEfklk3eAfKQDDDPr72QQ6z
++5c69kWjTM/VFIWIpXs5AauL5046Aq0VtJtYeF1JlHWguQXBxkV4ld48SQARAQAB
+tBtNaWNoYWVsIDxtZUBtaWNoYWVsMTAxMS5hdD6JAlQEEwEIAD4CGyMFCwkIBwIG
+FQoJCAsCBBYCAwECHgECF4AWIQTCZA9jBXD17e3gLeaE0km6cWhdRgUCZBXmtAUJ
+DTsB5QAKCRCE0km6cWhdRlA4D/90oA971y8i/hnGGbi3oK/30YOZKlNZ9/izqlHg
+5cyURBTA1+QzD9/TnDs59Z/MJXRINYlm/ZlYLvW2AjHXpIfdUl5oS0IFgFfr4HOQ
+yMA6VNnDYZTwZvzAwIf88qMFoXDQqaw89OuO8IOkKs/u8ivhDkM2NmyRmCdm4QQb
+Ule73mkGgwN9iUFS1woujVx5SoynK9uAQI4wWU8Osejft0AzZ2wSegQ8bujbLoqB
+vNB/sA5Whcbg8kG/gCO+hNJfDK7mROGbdizO8Y26ixQwps2NzKMFiPr6mpy9gbZl
+l5NTYlfg+TzcmtSnFFSC6lsX8iXDsYWdGcX+ERvhLe+TWcd6ztlaB0RUZX8SIa/H
+2yd8Kiu3sIQz/xTr45hK1hXRM0HUKYw0wrmVjmFGlKto2Aw3pRBfAxZQByB0It02
+sEBAApyQRpBWTHBy3yjCBz1GpeY5upR9KS+dqLveLdDPRlCQnMyEJKX0+hQVUnfv
+GD+02Q5LcLqsFq4NtY2jMI6OSXjMH5PwvDJmzKilqT70ebcKH6jCfo0/Nn39yyPo
+ICkkfjZo9i1pXUyhtOXBj8xEAazsRB/gnNn/itl8czs8aDMuGUl+uPbdsYShVI8J
+8BrGF4eRlzNLNIs3PJRGxJ0G9RS4rBGulbMUnPDt4t2NRX2E/4nCNLRN4MSMI29O
+eczS0YkCVAQTAQgAPhYhBMJkD2MFcPXt7eAt5oTSSbpxaF1GBQJanVAOAhsjBQkJ
+ZgGABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEITSSbpxaF1GtjcP/0gXYhlo
+IVXTtXvnShE4a1ZtUtU9EttX8icZfDe0gXn5D4lQwTgknWoDryvqeyDpsGtjHB13
+XpCJ32W/l3A067FyQ8/tUlrBX9cgmIbzSBiWw+Oe7HPIp9KcI2vudXAM0CHzID0l
+2dW+IVBalWJ2Bq/6kLHf+jHQAkfYzDrdfU1fWfVl0NEwhYiDY9qtP2WuTGUP1RVa
+/685HxQyiHfyiYWoJd3uDm03VAzZfeRnijNdAVZ76cwfyg2TA8g+eE2RZkcmZFm/
+dgB7DEvr0rPaM92vFAsxDQhUvgT38M1U+tTLjp31rLrb83IJkMNrjyVXXkFUqMac
+lvtAZLD+GJHGdDot2i/rdO2at+pvSzyLZBsSmSeMlH6yz3NScPeFuvkO3WNnl0D8
+ko/rAH85XZuoGcUGVHy5RE+9mzmU8QjBXnAeFV+etmlpUaJPzXeg+cmgFTpXuHwA
+u9zJqWzJNqKMw55tOa5MQyE0eN+GLLnn4x3rpnmtOkgP575tjqFlPCKONlNKEQRC
+4Dr6pC8729Bc2icvVYq/KuqwdDpj/iomjqh0Hm+GDydXdMOQRh1qO2fXw51uxIck
+S09lGIRUpvSU0tvpShde1RiGUXXw6a7PU5Yxqa9Mf/nkkcb/yddazOTuUjP4hceT
+qlgHitqXRx/Nl7GrO984ioRiVEKIsPteEiiMtB5NaWNoYWVsIDxtaWNoYWVsMTAx
+MTAxQG1lLmNvbT6JAlQEEwEIAD4CGyMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AW
+IQTCZA9jBXD17e3gLeaE0km6cWhdRgUCZBXmsQUJDTsB5QAKCRCE0km6cWhdRsds
+D/0YMb24yEnDZczVBZUYkFrEbERJ6ozeNwTeJt6W7YpEdkOyY0HcmPJFhRV0fclt
+P6EnIpbOEMAQtAxPiZAnWrT24PsP059BX/UxLqplvEgaAKEX6dVpLilI1y1dP7Dn
+wl2Z91QdF0gnI3+0Lan34J1BW67EmoPJUIdg+FIEGyuhsxVOhL4CJNqLU5KoicZi
+KeUm5EGXtQOnRyjq5rnrDQQtlu4T7gN3OtPDEOUwFunKyfb73+YIzK4XigPbmE8T
+pFHoffn9CD+g75NsnbRKB90opNIQgt9Q3rQ3l4nJrpK9FtP8wRjKjm+WtrfDJzpj
+s3DWQ6/I6viVyeWF5tQQbGL9YwhBRWO+SRNf80EGn8IEsmp3kxCAqKFhOSrS6JrK
+ZUpdkuDUTMxa1OXL2F3aSmcH1v+Fyd0mCUrhQTMn600gL8jaKHdJOPKhXGb+giQO
+QdSt3KSgOmJhldASBG1tyiyP/EaprqO4Yg8gtNyL1JXWFnRigklhK2UN/P37X3jA
+n+I+In0ABqUa0PQxZz4zR3C1r9n7mRuWviC650QQFAwJ55ddhw8211LF5caU89kx
+AcDcDgBj7s7Efau2Q4LAcbap5M51GFFxzeweXrD+RCXGG8rExKqwf7FEcfZY3gHw
+cs+1Jbi2B/A8Y+EcxNKZBcmvC+wB9vrPfL/ag7l7LthiD4kCVAQTAQgAPhYhBMJk
+D2MFcPXt7eAt5oTSSbpxaF1GBQJanUvMAhsjBQkJZgGABQsJCAcCBhUKCQgLAgQW
+AgMBAh4BAheAAAoJEITSSbpxaF1GK2AP/28AI/BMPb8NUmNnBhae6DLSNsRU4rat
+Eb9kQrOVui13wdO5xr1aEKc+Wd+cGxIHiTG+lTT59Fw4G+OP1BLP9I9iwRCRU3q5
+BIuEmblPamyXvoh2lHThu7Rjqv32eMolLQOiWGjb1gIEitdo7CPv41/F/v2xHcfh
+8ZvRAQjLlUkTYBoXKmtdOXp2Jb3u6cOmCokO2fZf+HxkHQw14aiCK5tIYrEFDbxh
++eraFk+JBLFAbn3jU5htvlnumh+AwbuISCHJ7PepfRgEesOFUR5Hd+RiPw1jR9Bu
+qrTCNQ9CZUyQyau8Qp4+Mn8Sgr+QZhWPUr4tYxKGDQa6FBt5ai1qWPGdKV8WlVMX
+8fHWnEjjPdweHYwNIEnLV1seABqkSCwZescfVcxKvzFZNP7B94RvOWMUjJfjXJ5D
+jLC1pGRtai+UGyE2wi+EczysgSLbp43N0g9zuGZmPRSmzpPp9nIJ4qouOAUd7CMB
+bnhRFTgSRvJ5XwykZLwbIU+OMRvK9EUvrXXEDZ0pMXfloQpEW5TkmeSZ3HNeAQaU
+lYp2eHR0nhoNQ1czjPQvEebg9vRw+Wfd7tWyxjQTmozC6vr2LMLD4wcsF9VfDMrt
+0QABAxhM9QRMYoht+hQlwHWy7Pcd2rLAZND/2FRgQZEn+aX1YBRXPZxotR77oQhQ
+hdCzkdrB1RJxuQINBFqdS8wBEADKQSi+BGpepbVmAxpogj/kctp68Y9ZiEwfVjOU
+uUYB/yPmWpvqjCPikvJ86DOE2jQOMq9HK68/6YYl9LLcwULnoOatn8t6PrySxcx0
+lAEmsOY/9MeylS7rqmLBUFCiV1sTPdzYrAr8hbpG308YKOu6L31c/uedbknMBZh+
+pmY2vvr7RFP8JJGfPS2pFKr5z/EyhB5J4mckpEAgMVbqmQdHV3aWvK9qbs/fHHoZ
+vL+l66Qf1w1Ut0WI8h/RmF4WTvnsopVwVK7S3Va9+vxkwfaslEFgaGBlebKD/D4m
+17QRhy1ljaIYNMo3GIP9v8k8Xms8gce52bALPR3f2MWdxmjDQZM/w9yPR09r77bn
+/DfZNg9Uqx4oJlewaKfrjnIIMP+OLMGn8Ey1ARw5o0rw/u0x9WauEo8DSrchyeoV
+XVJPrspPiZTbI/t8sMvegWS1HhTXhx/jNdSI3JpPLua57Jy4lDC0unTVAUykV6me
++59fVdlbtC9WsBZ+n2G54rShQruoKJCoWrovT/0lVNq0p7IKkgTi2HqsOVQVuxpe
+i/57DGXeb/4C4gkMbWfMAnrl1nYhn5OBQH+5k6vNG/8SW81AD4oPo/m7bE7oCCTN
+T0Pz7mfX8S0Veky0gTDxksPcwlznkooHVkb7LE+P1iJSDye/8AmWJt+LYvmtLst8
+NiNnOQARAQABiQI8BBgBCAAmAhsMFiEEwmQPYwVw9e3t4C3mhNJJunFoXUYFAmQV
+52YFCQ07ApoACgkQhNJJunFoXUa/5w/8CTP/s3dcqnXAHp3Js3XA6Sigi2zLcjjH
+8AjreFySKK0nE6Lyu774wuna0sWIyD/RNFodWoh9MzLTpeaMKzdL852GWs2ZiwJt
+gH3baNlBKq29wjFbaqOEgToNOPn8H7mtU7jo33M2ZMLBlpmXepqwjUl0W5bXAFVd
+sOIjpLDnsED9Yr7bCxJ+DLRpioIdSRBmMWxnGc/8ZXEeW4mGbhFCV7zCvGhpaIEt
+zX3d1yOMA7xn3W+U1gSjAVkOrDRVppp/PQ0PlpSZ+o8BhODkK8xsPnevhWmrmgNI
+HKFZwFJsPRxvdis/uueUMXU6lPaY+ocJl99b1TQiTk/X3sJb7Q0ERaYX1jYB4HBX
+CPPoWBcdv0h3ZZ6pvzhpZNrtPCABoRzydz+nD5ZtpPZ2grNt8KTXXkW2FPtRAwPA
+OxZKo2biVKtMydpCZ6SJtLMpREpWRAe+cPXv51nDrKK5BrY+0gq6bpKYd/Opir60
+3/GdTOel+DmRDmIzJHpET3umEYN1BWZwiZuo94AuS1hv0MYaN4HaImwoHYlbMSMW
+23NfGBCbOA6w/qgNYQ8Pod/E1Bvhr/BIOzK05ofc/CXP3zF/HknW+6PEF5YoctQH
+X98vuKVOWALnr6Ulmh/pHqKU1AKPzxOhIaYMLg1RS6I4BNobcR/IY3bp20BMPsre
+ikvlnCs353I=
+=RzTC
+-----END PGP PUBLIC KEY BLOCK-----