Check correct signature presence for release

tools/release.sh

@@ -34,6 +34,9 @@ else
     echo Releasing developer version "$version"...
 fi
 
+if [ "$RELEASE_OPENSSL_KEY" = "" ] ; then
+    RELEASE_OPENSSL_KEY="`realpath \`dirname $0\``/eff-pubkey.pem"
+fi
 RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-A2CFB51FA275A7286234E7B24D17C995CD9775F2}
 # Needed to fix problems with git signatures and pinentry
 export GPG_TTY=$(tty)
@@ -78,6 +81,14 @@ if [ "$RELEASE_BRANCH" != "candidate-$version" ] ; then
 fi
 git checkout "$RELEASE_BRANCH"
 
+if ! openssl dgst -sha1 -verify $RELEASE_OPENSSL_KEY -signature \
+        letsencrypt-auto-source/letsencrypt-auto.sig \
+        letsencrypt-auto-source/letsencrypt-auto            ; then
+   echo Failed letsencrypt-auto signature check on "$RELEASE_BRANCH"
+   echo please fix that and re-run
+fi
+
+
 SetVersion() {
     ver="$1"
     for pkg_dir in $SUBPKGS
@@ -112,6 +123,7 @@ do
   cd -
 done
 
+
 mkdir "dist.$version"
 mv dist "dist.$version/letsencrypt"
 for pkg_dir in $SUBPKGS