add checksum verification and signature step

Makefile

@@ -56,7 +56,7 @@ release-docker-mkcachemount:
 endif
 
 ##################### PRODUCING A RELEASE #############
-.PHONY: release wrapup-and-checksum check-git-clean sign clean ensure-release-toolchain
+.PHONY: release wrapup-and-checksum check-git-clean verify-and-sign clean ensure-release-toolchain
 
 ensure-release-toolchain:
 	# ensure the toolchain is actually the one we expect
@@ -211,7 +211,8 @@ tag-release:
 	test -n "$(ZREPL_TAG_VERSION)" || exit 1
 	git tag -u '328A6627FA98061D!' -m "$(ZREPL_TAG_VERSION)" "$(ZREPL_TAG_VERSION)"
 
-sign:
+verify-and-sign:
+	cd "$(ARTIFACTDIR)/release" && sha512sum -c sha512sum.txt
 	gpg -u '328A6627FA98061D!' \
 		--armor \
 		--detach-sign $(ARTIFACTDIR)/release/sha512sum.txt

README.md

@@ -112,6 +112,10 @@ The procedure to issue a release is as follows:
     ```
     make download-circleci-release JOB_NUM=66079
     ```
+  * Verify checksums and sign the checksums file:
+    ```
+    make verify-and-sign
+    ```
   * Create GitHub release and upload artifacts:
     ```bash
     gh release create vX.Y.Z --title "vX.Y.Z" --notes "See changelog" --draft