8 files changed, 47 insertions, 4 deletions
diff --git a/aux/workflow/README.sh b/aux/workflow/README.sh
index 83132744..c14fe3b6 100755
--- a/aux/workflow/README.sh
+++ b/aux/workflow/README.sh
@@ -9,7 +9,7 @@ MAILING_LIST="$3"
 
 RELEASES_LIST="$(mktemp)"
 for version in $(git tag); do
-  echo "- version [$version](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz), released in $(git log -1 --format=%cd --date=short "$version")" >> "$RELEASES_LIST"
+  echo "- version [$version](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz) ([sig](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz.asc)), released in $(git log -1 --format=%cd --date=short "$version")" >> "$RELEASES_LIST"
 done
 
 RELEASES="$(mktemp)"
diff --git a/aux/workflow/dist.sh b/aux/workflow/dist.sh
index 8f8f6170..b337ef0a 100755
--- a/aux/workflow/dist.sh
+++ b/aux/workflow/dist.sh
@@ -4,6 +4,7 @@ set -eu
 DATE="$1"
 VERSION="$2"
 VVERSION="v$2"
+PROJECT="$3"
 
 if git show "$VVERSION" 1>/dev/null 2>/dev/null; then
   echo "Version '$VVERSION' already exists." >&2
@@ -21,3 +22,5 @@ if ! grep -q "^# $VERSION - $DATE$" CHANGELOG.md; then
 fi
 
 git tag "$VVERSION"
+
+sh aux/workflow/sign-tarballs.sh "$PROJECT"
diff --git a/aux/workflow/sign-tarballs.sh b/aux/workflow/sign-tarballs.sh
new file mode 100755
index 00000000..b88ff332
--- /dev/null
+++ b/aux/workflow/sign-tarballs.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+PROJECT="$1"
+
+SIGNATURES="$(git notes --ref=refs/notes/signatures/tar.gz list | cut -d\  -f2)"
+for tag in $(git tag); do
+  COMMIT="$(git rev-list -n1 "$tag")"
+  if ! echo "$SIGNATURES" | grep -qF "$COMMIT"; then
+    echo "Adding missing signature to $tag" >&2
+    git notes --ref=refs/notes/signatures/tar.gz add -f -C "$(
+      git archive --format tar.gz --prefix "$PROJECT-${tag#v}/" "$tag" |
+      gpg --output - --armor --detach-sign |
+      git hash-object -w --stdin
+    )" "$tag"
+  fi
+done
diff --git a/sh/fake-symlinks.sh b/sh/fake-symlinks.sh
index 65f7c071..b17c30c9 100644
--- a/sh/fake-symlinks.sh
+++ b/sh/fake-symlinks.sh
@@ -179,6 +179,7 @@ ln_build_aux() {
          aux/workflow/README.sh       \
          aux/workflow/commonmark.sh   \
          aux/workflow/dist.sh         \
+         aux/workflow/sign-tarballs.sh \
          aux/workflow/public.sh
 
   cp_if_not TODOs.md
diff --git a/sh/templates/Makefile b/sh/templates/Makefile
index 019c3ea1..e50022f6 100644
--- a/sh/templates/Makefile
+++ b/sh/templates/Makefile
@@ -96,10 +96,12 @@ uninstall:
 clean:
 	rm -rf public/ $(objects) $(liba) $(libso-real) $(soaliases) run-tests fallible* vgcore*
 
+NAME = __PROJECT__
+
 dist:
-	sh aux/workflow/dist.sh $(DATE) $(VERSION)
+	sh aux/workflow/dist.sh $(DATE) $(VERSION) $(NAME)
 
 public: README.md TODOs.md CHANGELOG.md
-	sh aux/workflow/public.sh __PROJECT_UC__ __PROJECT__ __MAILING_LIST__
+	sh aux/workflow/public.sh __PROJECT_UC__ $(NAME) __MAILING_LIST__
 
 .PHONY: all clean check dev-check dist install uninstall
diff --git a/sh/templates/aux/workflow/README.sh b/sh/templates/aux/workflow/README.sh
index 83132744..c14fe3b6 100755
--- a/sh/templates/aux/workflow/README.sh
+++ b/sh/templates/aux/workflow/README.sh
@@ -9,7 +9,7 @@ MAILING_LIST="$3"
 
 RELEASES_LIST="$(mktemp)"
 for version in $(git tag); do
-  echo "- version [$version](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz), released in $(git log -1 --format=%cd --date=short "$version")" >> "$RELEASES_LIST"
+  echo "- version [$version](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz) ([sig](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz.asc)), released in $(git log -1 --format=%cd --date=short "$version")" >> "$RELEASES_LIST"
 done
 
 RELEASES="$(mktemp)"
diff --git a/sh/templates/aux/workflow/dist.sh b/sh/templates/aux/workflow/dist.sh
index 8f8f6170..b337ef0a 100755
--- a/sh/templates/aux/workflow/dist.sh
+++ b/sh/templates/aux/workflow/dist.sh
@@ -4,6 +4,7 @@ set -eu
 DATE="$1"
 VERSION="$2"
 VVERSION="v$2"
+PROJECT="$3"
 
 if git show "$VVERSION" 1>/dev/null 2>/dev/null; then
   echo "Version '$VVERSION' already exists." >&2
@@ -21,3 +22,5 @@ if ! grep -q "^# $VERSION - $DATE$" CHANGELOG.md; then
 fi
 
 git tag "$VVERSION"
+
+sh aux/workflow/sign-tarballs.sh "$PROJECT"
diff --git a/sh/templates/aux/workflow/sign-tarballs.sh b/sh/templates/aux/workflow/sign-tarballs.sh
new file mode 100755
index 00000000..b88ff332
--- /dev/null
+++ b/sh/templates/aux/workflow/sign-tarballs.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+PROJECT="$1"
+
+SIGNATURES="$(git notes --ref=refs/notes/signatures/tar.gz list | cut -d\  -f2)"
+for tag in $(git tag); do
+  COMMIT="$(git rev-list -n1 "$tag")"
+  if ! echo "$SIGNATURES" | grep -qF "$COMMIT"; then
+    echo "Adding missing signature to $tag" >&2
+    git notes --ref=refs/notes/signatures/tar.gz add -f -C "$(
+      git archive --format tar.gz --prefix "$PROJECT-${tag#v}/" "$tag" |
+      gpg --output - --armor --detach-sign |
+      git hash-object -w --stdin
+    )" "$tag"
+  fi
+done