add signature verification

README.md

@@ -29,6 +29,21 @@ $ curl -LO https://github.com/tonymet/gcloud-lite/releases/download/472.0.0/goog
 $ tar -zxf *gz
 ```
 
+## Verifying .tgz Release Signature
+`public-key.pub` is found in this repo
+`ARCHIVE` & `ARCHIVE.sig` are included in each release
+*Verified OK* is expected for a good signature.
+```
+PUBLIC_KEY=public-key.pub
+ARCHIVE=google-cloud-cli-487.0.0-linux-x86_64-lite.tar.gz
+openssl dgst -verify "${PUBLIC_KEY}" \
+    -signature "${ARCHIVE}.sig" 
+    "${ARCHIVE}"
+Verified OK
+```
+
+
+
 ## Benchmarks
 Tested on GCP Compute Instance e2-medium
 | Image        | Time      | Improvement |

lite-release.sh

@@ -7,7 +7,7 @@ die () {
 [[ -v PROJECT ]] || die "\$PROJECT is unset"
 [[ -v OBJECT ]] ||  die "\$OBJECT is unset"
 [[ -v BUCKET ]] ||  die "\$BUCKET is unset"
-[[ -v KMS_KEYPATH ]] ||  die "\$KMS_KEY_PATH is unset"
+[[ -v KMS_KEYPATH ]] ||  die "\$KMS_KEYPATH is unset"
 build_tarball(){
     [[ -v 1 ]] || die "\$1 is unset"
     [[ -v CLOUD_SDK_VERSION ]] || die "CLOUD_SDK_VERSION is unset"

public-key.pub

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHRBC+jfmUKS1uwF7a46kx6/nthdJ
+Sah1TVY2i2TuEMGyVW/4+diMSxVB4BILwtKhv5ZUiGwSlvioKGsShh3yTA==
+-----END PUBLIC KEY-----