From f50122d8d8b365369ef457cb187e2e57105adc01 Mon Sep 17 00:00:00 2001
From: Daniel Norman <daniel@norman.life>
Date: Mon, 9 Nov 2026 17:35:41 +0100
Subject: [PATCH] desktop: Sign the release tag

- Sign the release tag with the Radicle key, like the httpd tag
- Check that the signing key matches the Radicle identity first
- Document the Git signing setup in README.md
---
 desktop/README.md       |  7 +++++++
 desktop/scripts/release | 15 ++++++++++++---
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/desktop/README.md b/desktop/README.md
index 7bca2514b..8aa85de0e 100644
--- a/desktop/README.md
+++ b/desktop/README.md
@@ -72,6 +72,13 @@ npm run tauri build -- --debug --bundles app
 
 ## Releasing
 
+The release tag is signed with your Radicle key. Set up Git to sign with it:
+
+```
+git config set gpg.format ssh
+git config set user.signingKey "$(rad self --ssh-key)"
+```
+
 Releases are driven by an interactive, phased script. Start one with:
 
 ```
diff --git a/desktop/scripts/release b/desktop/scripts/release
index f0d56a54c..a2160e3ad 100755
--- a/desktop/scripts/release
+++ b/desktop/scripts/release
@@ -4,8 +4,8 @@
 # the desktop/ folder of the radicle-gui monorepo.
 #
 # Automates the mechanical steps of the release process and pauses at the human
-# gates (CI/patch approval, DMG smoke-test, the cross-repo apt signing, delegate
-# tag approval, Zulip announce). Each phase prints what to do next and the exact
+# gates (CI/patch approval, DMG smoke-test, the cross-repo apt signing, the
+# signed tag, Zulip announce). Each phase prints what to do next and the exact
 # flag to resume with. State is not persisted: the version comes from --version
 # (prep) or tauri.conf.json (later phases), and commit SHAs are derived from git.
 #
@@ -318,8 +318,17 @@ phase_tag() {
   [[ -n "$sha" ]] || fail "could not find the 'desktop: Release $version' commit (is the patch merged into master?)"
   info "Tagging commit: ${sha:-<release-commit-sha>}"
 
+  # The tag must be signed with the key of the delegate's Radicle identity.
+  local signing_key
+  signing_key="$(git -C "$PROJECT_DIR" config user.signingKey || true)"
+  if [[ -z "$signing_key" || "$signing_key" != "$(rad self --ssh-key)" ]]; then
+    fail "git's user.signingKey does not match 'rad self --ssh-key', see README.md"
+  fi
+
   local tag="releases/desktop/$version"
-  run git -C "$PROJECT_DIR" tag "$tag" "${sha:-<release-commit-sha>}" -m "desktop: Release $version"
+  run rad auth
+  run git -C "$PROJECT_DIR" tag --annotate --sign "$tag" "${sha:-<release-commit-sha>}" \
+    -m "desktop: Release $version"
   run git -C "$PROJECT_DIR" push rad "refs/tags/$tag"
   run rad sync