How to verify release assets

[Binly42]

after some research, might should be to run something like:

minisign -V -m clash-verge_1.2.0_amd64.AppImage.tar.gz -x <(base64 -d clash-verge_1.2.0_amd64.AppImage.tar.gz.sig) -P RWTlqsR6CqVaETI3nMKsdHYETIqRCY36zlu0ERcoawjRWW4Zx7Ri06af

note:

• both .sig and pubkey are base64-ed ...

• clash-verge/src-tauri/tauri.conf.json

  Line 60 in f3a917b

  "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDExNUFBNTBBN0FDNEFBRTUKUldUbHFzUjZDcVZhRVRJM25NS3NkSFlFVElxUkNZMzZ6bHUwRVJjb2F3alJXVzRaeDdSaTA2YWYK"

• might indeed not support gpg , and minisign seems becoming a better alternative (for file sign and verify) ~

---

PS: 话说 clash-verge_1.2.0_amd64.AppImage 本身好像没做签名额...