Adds the infrastructure for verifiable Triangles releases:
- Reproducible builds (default-on): -ffile-prefix-map strips absolute
source paths from binaries; SOURCE_DATE_EPOCH pinned to commit
timestamp if env var not set. Two builds of the same commit with the
same flags now produce byte-identical binaries.
- scripts/verify-reproducible-build.sh: builds the daemon twice into
separate build dirs and compares SHA256. Pass/fail printed clearly.
- scripts/sign-release.sh: generates SHA256SUMS, writes detached .asc
signatures over each release artifact and over SHA256SUMS itself.
Supports --verify for independent third-party verification.
- release-process.md: canonical release pipeline documentation --
reproducibility properties, signing-key setup, distribution
requirements, failure-mode recovery, and the release checklist.
- scripts/README.md: updated to catalog the full scripts/ directory
(was previously scoped only to bump-version.sh).
Verified end-to-end on this branch:
- scripts/verify-reproducible-build.sh: exit 0, both builds SHA256
7a86d9659b7150f69dc53eb31cc4c7eb8df296b55fa889af5c5a1b310223c894.
- scripts/sign-release.sh: signs Release-built artifact, --verify
returns exit 0 (all sigs + checksums valid).
- ctest: 4/4 suites still pass with the new compile flags.
- Tamper test: modifying an artifact after signing causes --verify
to fail with '1 checksum(s) FAILED' (exit 1).
Existing signing key in the local keyring is used:
523A81833EB7201573E1EFE1DCF2579968107984
(Krystie Triangles Release <krystie-triangles-release@dns2.sami.tailnet>)
CI integration (separate PR): add a 'sign' job to build-all.yml that
imports GPG_PRIVATE_KEY from secrets and runs scripts/sign-release.sh
against the assembled release directory. Documented in release-process.md.
Krystie