Please also add .asc signature file in the release artifact

[nileshpatra]

Debian checks for upstream sigs, and it seems that until release 4.0.2 a .asc file was supplied as well. But it's not present in the releases after this. Could you please add this for all future releases?

If possible, could it also be added to current latest release?

[krobelus]

Will do, thanks.

Some thoughts:

• part of the reason was that I didn't spend time on integrating signing in the new release automation
• we'll also GPG-sign future tags again.
• we probably want multiple people to make releases, I guess that means that the set of accepted signing keys will grow.
• we already have deposited macOS signing keys to GitHub, they produce signed packages for macOS
• I wonder who (if anyone) uses the tarball as opposed to the Git tag.
  I'd imagine that a packager who wants to check GPG signatures,
  likely also wants to use their own sphinx-build package rather than the one used by fish when creating the tarball.

So if we can delete the tarball, that would simplify things a bit.
Currently the tarball is created by a GitHub Actions workflow which I'm not sure everyone is comfortable trusting.
(Until we add back signatures, using git tags/branches would.)

The tarball build seems reproducible, so I'll probably make the release workflow run it on the local system too and compare the output..

[krobelus]

added .asc file to https://github.com/fish-shell/fish-shell/releases/tag/4.1.2