From 2eb3e09ca96b7b186ae2122510a0452036b86363 Mon Sep 17 00:00:00 2001
From: Peter Eckersley <pde@eff.org>
Date: Sun, 10 Jan 2016 22:57:49 -0800
Subject: [PATCH] Check correct signature presence for release

---
 tools/release.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tools/release.sh b/tools/release.sh
index 172f6fea1..2d427d49d 100755
--- a/tools/release.sh
+++ b/tools/release.sh
@@ -34,6 +34,9 @@ else
     echo Releasing developer version "$version"...
 fi
 
+if [ "$RELEASE_OPENSSL_KEY" = "" ] ; then
+    RELEASE_OPENSSL_KEY="`realpath \`dirname $0\``/eff-pubkey.pem"
+fi
 RELEASE_GPG_KEY=${RELEASE_GPG_KEY:-A2CFB51FA275A7286234E7B24D17C995CD9775F2}
 # Needed to fix problems with git signatures and pinentry
 export GPG_TTY=$(tty)
@@ -78,6 +81,14 @@ if [ "$RELEASE_BRANCH" != "candidate-$version" ] ; then
 fi
 git checkout "$RELEASE_BRANCH"
 
+if ! openssl dgst -sha1 -verify $RELEASE_OPENSSL_KEY -signature \
+        letsencrypt-auto-source/letsencrypt-auto.sig \
+        letsencrypt-auto-source/letsencrypt-auto            ; then
+   echo Failed letsencrypt-auto signature check on "$RELEASE_BRANCH"
+   echo please fix that and re-run
+fi
+
+
 SetVersion() {
     ver="$1"
     for pkg_dir in $SUBPKGS
@@ -112,6 +123,7 @@ do
   cd -
 done
 
+
 mkdir "dist.$version"
 mv dist "dist.$version/letsencrypt"
 for pkg_dir in $SUBPKGS