release: include a source tarball and sign everything #1449

Makefile

@@ -104,6 +104,19 @@ website:
 upload_website:	website
 	rclone -v sync docs/public memstore:www-rclone-org
 
+tarball:
+	git archive -9 --format=tar.gz --prefix=rclone-$(TAG) -o build/rclone-$(TAG).tar.gz $(TAG)
+
+sign_upload:
+	cd build && md5sum rclone-* | gpg --clearsign > MD5SUMS
+	cd build && sha1sum rclone-* | gpg --clearsign > SHA1SUMS
+	cd build && sha256sum rclone-* | gpg --clearsign > SHA256SUMS
+
+check_sign:
+	cd build && gpg --verify MD5SUMS && gpg --decrypt MD5SUMS | md5sum -c
+	cd build && gpg --verify SHA1SUMS && gpg --decrypt SHA1SUMS | sha1sum -c
+	cd build && gpg --verify SHA256SUMS && gpg --decrypt SHA256SUMS | sha256sum -c
+
 upload:
 	rclone -v copy build/ memstore:downloads-rclone-org
 

RELEASE.md

@@ -6,7 +6,7 @@ Making a release
   * git status - make sure everything is checked in
   * Check travis & appveyor builds are green
   * make check
-  * make test
+  * make test # see integration test server or run locally
   * make tag
   * edit docs/content/changelog.md
   * make doc
@@ -20,6 +20,9 @@ Making a release
   * git push --tags origin master:stable # update the stable branch for packager.io
   * # Wait for the appveyor and travis builds to complete then fetch the windows binaries from appveyor
   * make fetch_windows
+  * make tarball
+  * make sign_upload
+  * make check_sign
   * make upload
   * make upload_website
   * make upload_github
@@ -33,4 +36,4 @@ Early in the next release cycle update the vendored dependencies
   * carry forward any patches to vendor stuff
   * git commit -a -v
 
-Make the version number be just in a file?
+Make the version number be just in a file?