Add channel-aware release tooling and updater recovery

scripts/verify_release.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Verify one complete release artifact set before publication."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import sys
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+if str(PROJECT_ROOT) not in sys.path:
+	sys.path.insert(0, str(PROJECT_ROOT))
+
+from scripts.release_lib import ReleaseToolError, verify_release  # noqa: E402
+
+
+def build_parser() -> argparse.ArgumentParser:
+	parser = argparse.ArgumentParser(description=__doc__)
+	parser.add_argument("version")
+	parser.add_argument("channel")
+	parser.add_argument("output_directory", type=Path)
+	parser.add_argument("--public-key", type=Path)
+	parser.add_argument("--require-signature", action="store_true")
+	return parser
+
+
+def main() -> int:
+	arguments = build_parser().parse_args()
+	try:
+		verify_release(
+			arguments.version,
+			arguments.channel,
+			arguments.output_directory,
+			public_key=arguments.public_key,
+			require_signature=arguments.require_signature,
+		)
+	except (OSError, ValueError, ReleaseToolError) as exc:
+		print(f"Release verification failed: {exc}", file=sys.stderr)
+		return 1
+	print(
+		f"Verified {arguments.channel} release {arguments.version} in "
+		f"{arguments.output_directory}"
+	)
+	return 0
+
+
+if __name__ == "__main__":
+	raise SystemExit(main())