3 files changed, 22 insertions, 2 deletions
diff --git a/aux/workflow/README.sh b/aux/workflow/README.sh
index 8313274..e30344f 100755
--- a/aux/workflow/README.sh
+++ b/aux/workflow/README.sh
@@ -8,8 +8,8 @@ PROJECT="$2"
 MAILING_LIST="$3"
 
 RELEASES_LIST="$(mktemp)"
-for version in $(git tag); do
-  echo "- version [$version](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz), released in $(git log -1 --format=%cd --date=short "$version")" >> "$RELEASES_LIST"
+for version in $(git tag | perl -e 'print reverse <>'); do
+  echo "- version [$version](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz) ([sig](https://git.euandreh.xyz/$PROJECT/snapshot/$PROJECT-$version.tar.gz.asc)), released in $(git log -1 --format=%cd --date=short "$version")" >> "$RELEASES_LIST"
 done
 
 RELEASES="$(mktemp)"
diff --git a/aux/workflow/dist.sh b/aux/workflow/dist.sh
index 8f8f617..b337ef0 100755
--- a/aux/workflow/dist.sh
+++ b/aux/workflow/dist.sh
@@ -4,6 +4,7 @@ set -eu
 DATE="$1"
 VERSION="$2"
 VVERSION="v$2"
+PROJECT="$3"
 
 if git show "$VVERSION" 1>/dev/null 2>/dev/null; then
   echo "Version '$VVERSION' already exists." >&2
@@ -21,3 +22,5 @@ if ! grep -q "^# $VERSION - $DATE$" CHANGELOG.md; then
 fi
 
 git tag "$VVERSION"
+
+sh aux/workflow/sign-tarballs.sh "$PROJECT"
diff --git a/aux/workflow/sign-tarballs.sh b/aux/workflow/sign-tarballs.sh
new file mode 100755
index 0000000..b88ff33
--- /dev/null
+++ b/aux/workflow/sign-tarballs.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+PROJECT="$1"
+
+SIGNATURES="$(git notes --ref=refs/notes/signatures/tar.gz list | cut -d\  -f2)"
+for tag in $(git tag); do
+  COMMIT="$(git rev-list -n1 "$tag")"
+  if ! echo "$SIGNATURES" | grep -qF "$COMMIT"; then
+    echo "Adding missing signature to $tag" >&2
+    git notes --ref=refs/notes/signatures/tar.gz add -f -C "$(
+      git archive --format tar.gz --prefix "$PROJECT-${tag#v}/" "$tag" |
+      gpg --output - --armor --detach-sign |
+      git hash-object -w --stdin
+    )" "$tag"
+  fi
+done