[pkg] hash and sign artifacts

Makefile

@@ -393,6 +393,14 @@ package_snap:
 package_deb:
 	@make -C build/${PROVIDER} pkg_deb
 
+sign_artifact:
+	@find ${FILE} -type f -not -name "*.asc" -print0 | xargs -0 -n1 -I{} sha256sum -b "{}" | sed 's/*deploy\///' > ${FILE}.sha256
+	@gpg --clear-sign --armor ${FILE}.sha256
+
+upload_artifact:
+	scp ${FILE} downloads.leap.se:./
+	scp ${FILE}.sha256.asc downloads.leap.se:./
+
 
 #########################################################################
 # icons & locales

docs/build-win.rst

@@ -51,6 +51,15 @@ or all together as::
 
   make package_win_release
 
+Uploading installer
+-------------------
+
+Since 0.21.2, we're hashing and signing the installers::
+
+  export FILE=deploy/RiseupVPN-installer-0.21.2.exe
+  make sign_artifact
+  make upload_artifact
+
 
 unreviewed notes
 ----------------