Create signchecksum script (#396)

Resolves #393

MAINTAINING.md

@@ -15,3 +15,11 @@ $ yarn release
 ```
 
 Then edit the automatically created GitHub Releases draft and publish.
+
+Once the release is published you can automatically generate a signed checksum file with:
+
+```
+$ ./signedchecksum
+```
+
+It will create a file called `SHASUMS256.txt.asc` that you need to upload to the GitHub release manually.

signedchecksum

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+run_dir=$(pwd)
+cd $(mktemp -d)
+
+echo "Downloading build artefacts to temporary directory:"
+pwd
+
+curl https://api.github.com/repos/hyperdexapp/hyperdex/releases/latest | jq '.assets[].browser_download_url' | xargs wget
+
+echo "Calculating checksums and signing the result..."
+
+export GPG_TTY=$(tty)
+shasum --algorithmn 256 * | gpg --clearsign > "$run_dir/SHASUMS256.txt.asc"
+
+echo "Created SHASUM256.txt.asc"