Add channel-aware release tooling and updater recovery

scripts/verify_metadata.py

@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""Verify a detached release-metadata signature with the launcher public key."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import sys
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+if str(PROJECT_ROOT) not in sys.path:
+	sys.path.insert(0, str(PROJECT_ROOT))
+
+from scripts.release_lib import ReleaseToolError, verify_signature  # noqa: E402
+
+
+def main() -> int:
+	parser = argparse.ArgumentParser(description=__doc__)
+	parser.add_argument("source", type=Path)
+	parser.add_argument("signature", type=Path)
+	parser.add_argument(
+		"--public-key",
+		type=Path,
+		default=PROJECT_ROOT / "ptlinux/launcher-update-public.pem",
+	)
+	arguments = parser.parse_args()
+	try:
+		verify_signature(arguments.source, arguments.signature, arguments.public_key)
+	except (OSError, ReleaseToolError) as exc:
+		print(f"Metadata verification failed: {exc}", file=sys.stderr)
+		return 1
+	return 0
+
+
+if __name__ == "__main__":
+	raise SystemExit(main())