message: guix-attest: Produce and sign normalized documents
  That way we can easily combine the document and detached signature to
  produce cleartext signature files for upload during the release process.
  See subsequent commits which modify doc/release-process.md for more
  details.
diff: @@ -159,6 +159,20 @@ Hint: You may wish to remove the existing attestations and their signatures by
  EOF
  }
  +# Given a document with unix line endings (just <LF>) in stdin, make all lines
  +# end in <CR><LF> and make sure there's no trailing <LF> at the end of the file.
  +#
  +# This is necessary as cleartext signatures are calculated on text after their
  +# line endings are canonicalized.
  +#
  +# For more information:
  +# 1. https://security.stackexchange.com/a/104261
  +# 2. https://datatracker.ietf.org/doc/html/rfc4880#section-7.1
  +#
  +rfc4880_normalize_document() {
  + sed 's/$/\r/' | head -c -2
  +}
  +
  echo "Attesting to build outputs for version: '${VERSION}'"
  echo ""
  @@ -174,6 +188,7 @@ mkdir -p "$outsigdir"
  cat "${noncodesigned_fragments[@]}" \
  | sort -u \
  | sort -k2 \
  + | rfc4880_normalize_document \
  > "$temp_noncodesigned"
  if [ -e noncodesigned.SHA256SUMS ]; then
  # The SHA256SUMS already exists, make sure it's exactly what we
  @@ -201,6 +216,8 @@ mkdir -p "$outsigdir"
  cat "${sha256sum_fragments[@]}" \
  | sort -u \
  | sort -k2 \
  + | sed 's/$/\r/' \
  + | rfc4880_normalize_document \
  > "$temp_codesigned"
  if [ -e codesigned.SHA256SUMS ]; then
  # The SHA256SUMS already exists, make sure it's exactly what we
  @@ -226,6 +243,7 @@ mkdir -p "$outsigdir"
  for i in *.SHA256SUMS; do
  if [ ! -e "$i".asc ]; then
  gpg --detach-sign \
  + --digest-algo sha256 \
  --local-user "$gpg_key_name" \
  --armor \
  --output "$i".asc "$i"
  