From efdef1e8b3d6ff3c114b544949c7dbaf9d3508c0 Mon Sep 17 00:00:00 2001
From: Christian Schwarz <me@cschwarz.com>
Date: Sun, 15 Feb 2026 18:52:13 +0000
Subject: [PATCH] add checksum verification and signature step

---
 Makefile  | 5 +++--
 README.md | 4 ++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index c185cc5..29e93b9 100644
--- a/Makefile
+++ b/Makefile
@@ -56,7 +56,7 @@ release-docker-mkcachemount:
 endif
 
 ##################### PRODUCING A RELEASE #############
-.PHONY: release wrapup-and-checksum check-git-clean sign clean ensure-release-toolchain
+.PHONY: release wrapup-and-checksum check-git-clean verify-and-sign clean ensure-release-toolchain
 
 ensure-release-toolchain:
 	# ensure the toolchain is actually the one we expect
@@ -211,7 +211,8 @@ tag-release:
 	test -n "$(ZREPL_TAG_VERSION)" || exit 1
 	git tag -u '328A6627FA98061D!' -m "$(ZREPL_TAG_VERSION)" "$(ZREPL_TAG_VERSION)"
 
-sign:
+verify-and-sign:
+	cd "$(ARTIFACTDIR)/release" && sha512sum -c sha512sum.txt
 	gpg -u '328A6627FA98061D!' \
 		--armor \
 		--detach-sign $(ARTIFACTDIR)/release/sha512sum.txt
diff --git a/README.md b/README.md
index b230f0b..df43b2a 100644
--- a/README.md
+++ b/README.md
@@ -112,6 +112,10 @@ The procedure to issue a release is as follows:
     ```
     make download-circleci-release JOB_NUM=66079
     ```
+  * Verify checksums and sign the checksums file:
+    ```
+    make verify-and-sign
+    ```
   * Create GitHub release and upload artifacts:
     ```bash
     gh release create vX.Y.Z --title "vX.Y.Z" --notes "See changelog" --draft