Add channel-aware release tooling and updater recovery

scripts/sign_metadata.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""Sign release metadata and verify it against the launcher's public key."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import sys
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+if str(PROJECT_ROOT) not in sys.path:
+	sys.path.insert(0, str(PROJECT_ROOT))
+
+from scripts.release_lib import (  # noqa: E402
+	ReleaseToolError,
+	sign_file,
+	verify_signature,
+)
+
+
+def main() -> int:
+	parser = argparse.ArgumentParser(description=__doc__)
+	parser.add_argument("source", type=Path)
+	parser.add_argument("signature", type=Path)
+	parser.add_argument("private_key", type=Path)
+	parser.add_argument(
+		"--public-key",
+		type=Path,
+		default=PROJECT_ROOT / "ptlinux/launcher-update-public.pem",
+	)
+	arguments = parser.parse_args()
+	try:
+		sign_file(arguments.source, arguments.signature, arguments.private_key)
+		verify_signature(
+			arguments.source,
+			arguments.signature,
+			arguments.public_key,
+		)
+	except (OSError, ReleaseToolError) as exc:
+		print(f"Metadata signing failed: {exc}", file=sys.stderr)
+		return 1
+	return 0
+
+
+if __name__ == "__main__":
+	raise SystemExit(main())