HOWTO-RELEASE: add signing

HOWTO-RELEASE

@@ -315,7 +315,14 @@ e) Click the "Release" button and that is it! The release should be available in
 18) Create a release on GitHub
     Go to https://github.com/OSGeo/gdal/releases/new
     And create a release for the vX.Y.Z tag
-    Attach the gdal-X.Y.Z.tar.gz, gdal-X.Y.Z.tar.gz.md5, gdalXYZ.zip, gdalXYZ.zip.md5 and gdalautotest-X.Y.Z.zip files
+    Attach the following files:
+    - gdal-X.Y.Z.tar.gz
+    - gdal-X.Y.Z.tar.gz.sig
+    - gdal-X.Y.Z.tar.gz.md5
+    - gdalXYZ.zip
+    - gdalXYZ.zip.sig
+    - gdalXYZ.zip.md5
+    - gdalautotest-X.Y.Z.zip
 
 19) Regenerate Docker images
 

mkgdaldist.sh

@@ -22,6 +22,8 @@ if test $rc != 0; then
     exit $rc;
 fi
 
+gpg2 --version >/dev/null || (echo "gpg2 not available"; exit 1)
+
 GITURL="https://github.com/OSGeo/gdal"
 
 if [ $# -lt 1 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ] ; then
@@ -195,6 +197,17 @@ $MD5 "gdal-${GDAL_VERSION}${RC}.tar.xz" > "gdal-${GDAL_VERSION}${RC}.tar.xz.md5"
 $MD5 "gdal-${GDAL_VERSION}${RC}.tar.gz" > "gdal-${GDAL_VERSION}${RC}.tar.gz.md5"
 $MD5 "gdal${COMPRESSED_VERSION}${RC}.zip" > "gdal${COMPRESSED_VERSION}${RC}.zip.md5"
 
+
+echo "* Signing..."
+export GPG_TTY=$(tty)
+for file in "gdal-${GDAL_VERSION}${RC}.tar.xz" "gdal-${GDAL_VERSION}${RC}.tar.gz" "gdal${COMPRESSED_VERSION}${RC}.zip"; do \
+  gpg2 --output ${file}.sig --detach-sig $file ; \
+done
+
+for file in "gdal-${GDAL_VERSION}${RC}.tar.xz" "gdal-${GDAL_VERSION}${RC}.tar.gz" "gdal${COMPRESSED_VERSION}${RC}.zip"; do \
+  gpg2 --verify ${file}.sig $file ; \
+done
+
 echo "* Cleaning..."
 rm -rf dist_wrk